A security-sensitive value is generated with System.Random or Guid.NewGuid() inside a token/secret/OTP generator.

Why this matters

System.Random is a non-cryptographic PRNG seeded from the clock: its output is predictable and its state is recoverable from a few samples, so an attacker can reconstruct the "random" secret (CWE-338). Guid.NewGuid() is not guaranteed to be cryptographically random either. AI tools paste these in because they look random enough.

Use System.Security.Cryptography.RandomNumberGenerator instead, e.g. RandomNumberGenerator.GetBytes(32) (then Base64/hex encode) or RandomNumberGenerator.GetInt32(...).

using System;

public class TokenService
{
    public string GenerateResetToken()
    {
        // ruleid: auth.csharp.crypto.insecure-random
        return new Random().Next(100000, 999999).ToString();
    }

    public string CreateApiKey()
    {
        // ruleid: auth.csharp.crypto.insecure-random
        return Guid.NewGuid().ToString("N");
    }
}

using System;
using System.Security.Cryptography;

public class TokenService
{
    public string GenerateResetToken()
    {
        // ok: cryptographically secure RNG
        var bytes = RandomNumberGenerator.GetBytes(32);
        return Convert.ToBase64String(bytes);
    }

    // ok: Random used for a non-security purpose in a non-security method
    public int RollDice()
    {
        return new Random().Next(1, 6);
    }
}

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.csharp.crypto.insecure-random -- <reason>

References