Insufficient Entropy in Password Generation

@@ -17,6 +17,7 @@
 
 namespace TYPO3\CMS\Core\Crypto;
 
+use Random\Randomizer;
 use TYPO3\CMS\Core\Exception\InvalidPasswordRulesException;
 use TYPO3\CMS\Core\Utility\StringUtility;
 
@@ -105,6 +106,7 @@ public function generateRandomPassword(array $passwordRules): string
                 );
             }
 
+            // enforces that at least one character matches the requirements
             foreach ($characterSets as $characterSet) {
                 $password .= $characterSet[random_int(0, strlen($characterSet) - 1)];
             }
@@ -114,7 +116,7 @@ public function generateRandomPassword(array $passwordRules): string
                 $password .= $characters[random_int(0, $charactersCount - 1)];
             }
 
-            str_shuffle($password);
+            $password = (new Randomizer())->shuffleBytes($password);
         }
 
         return $password;

@@ -204,4 +204,20 @@ public function generateRandomPasswordGeneratesRandomWithLength(
     ): void {
         self::assertEquals($length, strlen((new Random())->generateRandomPassword($passwordRules)));
     }
+
+    #[Test]
+    public function generateRandomPasswordIsUnpredictable(): void
+    {
+        $subject = new Random();
+        $max = 1000;
+        $count = 0;
+        for ($i = 0; $i < $max; $i++) {
+            $result = $subject->generateRandomPassword(['passwordLength' => 12]);
+            if (preg_match('/^[a-z][A-Z][0-9]/', $result)) {
+                $count++;
+            }
+        }
+        self::assertNotEquals($max, $count);
+        self::assertLessThan(0.1, $count / $max);
+    }
 }