Predictable credential generation is a weakness where passwords, tokens, session IDs, reset codes, or other access values are created with too little randomness. If an attacker can estimate the pattern, they may guess valid credentials instead of stealing them directly. This is a form of low-entropy security failure.
It matters because authentication depends on secrets being hard to predict. In practice, attackers probe for reused counters, timestamps, device serial numbers, or weak pseudo-random number generators that produce guessable values. When successful, they may bypass login, hijack a session, or access administrative functions without brute-forcing a strong password. Defenders reduce this risk by using cryptographically secure random generators, avoiding derived secrets, and testing that tokens and codes are unique, unguessable, and long enough to resist enumeration.