Language: Java
Label: vulnerable
CWE: CWE-338 \u2014 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.

Code:
	protected void onInitialize() {
		super.onInitialize();

		IModel<String> valueModel = new AbstractReadOnlyModel<String>() {

			@Override
			public String getObject() {
				return getUser().getAccessToken();
			}
			
		};
		add(new TextField<String>("value", valueModel) {

			@Override
			protected String[] getInputTypes() {
				return new String[] {"password"};
			}
			
		});
		
		add(new CopyToClipboardLink("copy", valueModel));
		
		add(new Link<Void>("regenerate") {

			@Override
			public void onClick() {
				getUser().setAccessToken(RandomStringUtils.randomAlphanumeric(User.ACCESS_TOKEN_LEN));
				OneDev.getInstance(UserManager.class).save(getUser());
				Session.get().success("Access token regenerated");
				setResponsePage(getPage());
			}
			
		}.add(new ConfirmClickModifier("This will invalidate current token and generate a new one, do you want to continue?")));
	}