CVE-2026-93868 - Cotonti through 1.0.0 Predictable Password Recovery Token via Weak PRNG
Brief
CVE ID : CVE-2026-93868
Published : Sept. 18, 2026, 8:17 p. m.
- 38 minutes ago
Description : Cotonti through 1.
- 0 derives password recovery validation tokens from md5(microtime()) in users. passrecover. php, creating a predictable token space of approximately one million values per second.
Unauthenticated attackers can read the server Date header, precompute candidate tokens within a narrow time window, and probe them against the passrecover authentication endpoint to reset any account password including administrators.
Severity: 9.2
- CRITICAL
Visit the link for more details, such as CVSS details, affected products, timeline, and more...