CVE-2026-93868 — Cotonti through 1.0.0 Predictable Password Recovery Token via Weak PRNG
Cotonti through 1.0.0 derives password recovery validation tokens from md5(microtime()) in users.passrecover.php, creating a predictable token space of approximately one million…
Published: 2026-09-18 · CVSS: 9.2 · CVSS 4.0
Cotonti through 1.0.0 derives password recovery validation tokens from md5(microtime()) in users.passrecover.php, creating a predictable token space of approximately one million values per second. Unauthenticated attackers can read the server Date header, precompute candidate tokens within a narrow time window, and probe them against the passrecover authentication endpoint to reset any account password including administrators.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7