CVE-2026-93868
HIGHCVSS 8.1Description
Cotonti through 1.0.0 derives password recovery validation tokens from md5(microtime()) in users.passrecover.php, creating a predictable token space of approximately one million values per second. Unauthenticated attackers can read the server Date header, precompute candidate tokens within a narrow time window, and probe them against the passrecover authentication endpoint to reset any account password including administrators.
Timeline
Published:September 18th, 2026 8:17 PM
Last modified:September 22nd, 2026 8:53 PM
CVSS Scoring
CVSS v3: 8.1 (HIGH)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses (CWE)
References & Reports
Advisories, patches, and third-party reports
- https://github.com/Cotonti/Cotonti
- https://github.com/Cotonti/Cotonti/blob/1.0.0/modules/users/inc/users.passrecover.php
- https://github.com/Cotonti/Cotonti/issues/1890
- https://github.com/Cotonti/Cotonti/pull/1898
- https://www.vulncheck.com/advisories/cotonti-through-1.0.0-predictable-password-recovery-token-via-weak-prng
- https://github.com/Cotonti/Cotonti/issues/1890
Source: NIST NVD · Data may lag official sources by up to one minute