Collected research

Cracking the Odd Case of Randomness in Java

joseph · elttam.com

A meet-in-the-middle attack recovers the 48-bit state of java.util.Random from a handful of outputs of nextInt with an odd bound, splitting the LCG equation into upper and lower state halves and matching candidates through a table.

Record

Researcher

joseph

Published by

elttam.com

Topic

Server

In the archive

• Collected in the 2023 research round

Related sources

• Attack implementation
• Follow-up prior-art discussion

Tags

• java
• auth-bypass
• tooling
• prior-art-extension
• owasp-a01-2021

This page is the archive's own catalogue record. The research is the work of joseph, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 14 August 2026.