Using java.util.Random or Math.random to generate tokens or secrets yields predictable values.
Use java.security.SecureRandom for tokens, session IDs, and any security-sensitive values.