Piwigo is image gallery software written in PHP. When a criteria is not met on a host, piwigo defaults to usingmt_rand in order to generate password reset tokens. mt_rand output can be predicted after recovering the seed used to generate it. This low an unauthenticated attacker to take over an account providing they know an administrators email address in order to be able to request password reset.
Current functions used to generate random strings are not "that much random" (depending on the PHP version and operating system).

increase randomness on generate_key
This is a GitHub Issue
repo:Piwigo
owner:Piwigo
Title : increase randomness on generate_key
Issue date:

--- start body ---
Current functions used to generate random strings are not "that much random" (depending on the PHP version and operating system).

--- end body ---
