CVE-2023-4472 is a critical (CVSS 9.8) flaw in ObjectPlanet Opinio version 7.22 and earlier. A weak pseudo random number generator with a predictable seed could allow unauthenticated takeover of any user account. ObjectPlanet fixed it in version 7.23, released 31 August 2023, so upgrade to 7.23 or later.
What's affected
The NVD record says Opinio version 7.22 and prior uses a cryptographically weak pseudo random number generator coupled to a predictable seed, which could lead to unauthenticated account takeover of any user.
Mandiant, who reported the issue, says the weak generator sat behind the password reset flow, where the reset token could be guessed after a reasonable number of requests. ObjectPlanet released a fix in Opinio 7.23. The vendor changelog lists 7.23 with the date 31 August 2023, and later releases such as 7.24 follow it. The changelog entries we read do not call out the security change by name, so rely on the Mandiant disclosure for the link between this CVE and 7.23.
Mandiant held back its public disclosure to let customers patch, and published on 1 February 2024 in coordination with the vendor.
How to check if you're exposed
Find the Opinio version in the application admin pages or in the deployed web archive. Anything at 7.22 or lower is in scope.
Review your password reset activity. A burst of reset requests for one account, or many requests from one address, followed by a successful reset, deserves a closer look.
Check for password changes that users did not ask for, and for new sessions from unfamiliar locations on administrator accounts.
If you run Opinio behind a reverse proxy or web application firewall, a rate limit on the reset endpoint is a cheap extra layer, although it is not a fix.
What to do now
- Upgrade Opinio to 7.23 or later, ideally the latest release.
- After the upgrade, force a password reset for administrator accounts and any account with a suspicious reset record.
- Invalidate outstanding reset tokens and active sessions.
- Enable multi factor authentication if your edition supports it.
- Rate limit and alert on password reset requests.
Why it matters
The weakness is CWE-335, incorrect use of seeds in a pseudo random number generator. A reset token is only as safe as the randomness behind it. If the generator is predictable, an attacker can work out the next token without ever seeing the email.
Mandiant says the fix replaced the weak generator with the Java SecureRandom class and no seed. That is the standard repair for this class of bug. The record does not claim exploitation in the wild and the CVE is not in the CISA KEV catalog. Any application that issues reset links, invite links or API keys should draw them from a cryptographic generator.
Quick check
Do I need to know the user email to attack the account?
The record says any user account could be taken over without authentication. The practical lesson is to patch rather than rely on the secrecy of accounts.
Sources
Last reviewed: 19 October 2026.
