Search

CVE-2026-93868 - Cotonti through 1.0.0 Predictable Password Recovery Token via Weak PRNG

CVE ID : CVE-2026-93868 Published : Sept. 18, 2026, 8:17 p. m. • 38 minutes ago Description : Cotonti through 1. 0. 0 derives password recovery validation tokens from md5(microtime()) in users. passrecover. php, creating a predictable token space of approximately one million values per second. Unauthenticated attackers can read the server Date header, precompute candidate tokens within a narrow time window, and probe them against the passrecover authentication endpoint to reset any account password including administrators. Severity: 9.2 • CRITICAL Visit the link for more details, such as CVSS details, affected products, timeline, and more...