What Is Generation of Predictable Numbers or Identifiers?

By NHI Mgmt Group Updated October 17, 2026 Domain: Cyber Security

Generation of Predictable Numbers or Identifiers is the creation of values that are easy to guess, such as account numbers, reset tokens or object IDs. Attackers can enumerate them to access other users’ data or operations. Defenders should use non-sequential, high-entropy identifiers and verify access on every request.

Why predictable identifiers are dangerous

Predictable numbers and identifiers turn object references into guessable targets. If an application exposes sequential IDs, reset tokens, or account numbers, an attacker can enumerate values and test whether they unlock data or actions tied to other users.

The core problem is not the identifier itself, but what the application allows that identifier to reach. If access checks are weak, the ID becomes an oracle for other records, sessions, or operations, and the weakness can spread across APIs, web apps, and internal workflows.

How predictable identifiers are typically created

This weakness often comes from convenience-driven design: counters, timestamps, short random values, or IDs generated from visible patterns. Those schemes can be sufficient for ordering or logging, but they are poor choices for anything that must resist guessing or enumeration.

Predictability also appears when teams reuse the same identifier pattern across multiple features, or when they assume obscurity alone protects access. A system may hide a reference in the UI while still exposing it in URLs, API responses, exports, or event messages.

Why guessing IDs leads to real compromise

When an attacker can predict identifiers, they can move from one known object to nearby objects and probe for access control failures. That is why this issue is closely associated with broken authorization patterns, especially where the server trusts a user-supplied reference without checking ownership on every request.

The impact is often data exposure rather than noisy intrusion. A guessed object ID can reveal profiles, orders, documents, or privileged actions if the application treats the identifier as proof of entitlement.

What secure identifier design looks like

Strong identifier design uses high-entropy, non-sequential values that are difficult to enumerate and that do not reveal business meaning. More importantly, the server must verify authorization for each object access instead of treating an ID as a sufficient claim.

Good design also reduces accidental leakage. Keep sensitive identifiers out of logs, avoid predictable reset links, and make sure API responses do not expose internal sequencing that helps attackers guess the next valid value.

Risk and Threat Considerations

Predictable identifiers create a direct enumeration risk because they let attackers test adjacent values until they find something they should not see. The danger increases when the identifier is used in URLs, APIs, reset flows, or other object-specific operations.

Failure mechanism: The application exposes a guessable reference and then fails to validate access to the underlying object, so the attacker can pivot from one valid value to the next.

Impact: Unauthorized disclosure, account or record takeover, and unintended operations on other users’ data can result, especially when the identifier gates a sensitive workflow.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

OWASP API Security Top 10 addresses the attack and risk surface, while NIST SP 800-53 Rev 5, OWASP ASVS and CIS Controls v8 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
OWASP API Security Top 10	API1 — Broken Object Level Authorization	Predictable IDs become dangerous when callers can access other objects by guessing references.
Recommendation — Enforce object-level authorization checks on every request, regardless of whether the identifier looks random.
NIST SP 800-53 Rev 5	AC-3 — Access Enforcement	The term depends on enforcing access decisions for object references, not trusting the identifier alone.
Recommendation — Apply AC-3 to verify authorization before returning any object or operation tied to a user-supplied ID.
OWASP ASVS	V8 — Authorization	ASVS authorization requirements directly address user-controlled references and access to protected objects.
Recommendation — Validate that each object reference is authorized for the current user before allowing access or modification.
CIS Controls v8	CIS-6 — Access Control Management	Predictable identifiers often lead to unauthorized access paths that strong access control management should prevent.
Recommendation — Review access paths and remove object reference patterns that let users reach data beyond their entitlement.

Practitioner Guidance

Why practitioners should care: Treat identifier predictability as an access control issue, not just a formatting issue. If users can guess references, every endpoint that consumes them needs a fresh entitlement check.

Common misunderstanding: Random-looking IDs are not enough if the application still trusts the caller. The control failure is often the missing ownership check, not only the identifier format.

Practitioner takeaway: Use opaque, high-entropy identifiers and verify object-level authorization on every request, including APIs, exports, and reset or recovery flows.

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 17, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org

Generation of Predictable Numbers or Identifiers