CWE-760 Predictable Salt in One-Way Hash

Coverage: 5 rules in the SiteShadow rule registry target this CWE (registry v2.0.0). Regex 5 Also: Taint and heuristic analyzers may also detect related flows (see coverage for the authoritative list) Registry tagging shows intent, for sample-level behaviour and benchmarked gaps see known gaps.

What this means

SiteShadow flagged a salt that appears static or predictable (hardcoded constant, reused across users, derived from usernames or timestamps). A salt needs to be unique and unpredictable per password hash.

Why it matters

Predictable salts reduce the effectiveness of hashing defenses.

• Precomputation becomes possible again if many users share a salt.
• Targeted cracking is faster when attackers can guess/derive the salt.
• Cross-user correlation remains possible with reused salts.

Safer examples

1) Use a password hashing library that generates salts for you

import bcrypt from "bcryptjs";

const hash = await bcrypt.hash(password, 12); // salt generated internally

2) If you manage salts manually, generate random per-user salts

import secrets

salt = secrets.token_bytes(16)  # per password

3) Don't derive salts from user data

Avoid salts like salt = username or salt = created_at. Use randomness.

How SiteShadow detects it (high level)

• Detects reuse of constant/predictable salts near hashing routines.
• Flags salts derived from low-entropy or user-controlled values.

References

• CWE-760: https://cwe.mitre.org/data/definitions/760.html

---

← Back to Vulnerability Library