CVE-2026-121553
Cotonti through 1.0.0 Predictable Validation Tokens via md5(microtime())
CVSS Score
4.8
EPSS Score
0.0%
EPSS Percentile
0th
Cotonti through 1.0.0 generates registration and email-change validation tokens with md5(microtime()), allowing attackers to bypass email-ownership verification by predicting tokens. Attackers can derive the generation time from the HTTP Date header and compute candidate tokens offline. They then submit these tokens to the users.register.php validate handler to activate accounts or confirm email addresses they do not control.
| CWE | CWE-338 |
| Vendor | cotonti |
| Product | cotonti |
| Published | Nov 3, 2026 |
Stay Ahead of the Next One
Get instant alerts for cotonti cotonti
Be the first to know when new medium vulnerabilities affecting cotonti cotonti are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
Low
Availability
Low
Affected Versions
cotonti / cotonti
0 ≤ 1.0.0
References
github.com: https://github.com/Cotonti/Cotonti/issues/1904 github.com: https://github.com/Cotonti/Cotonti github.com: https://github.com/Cotonti/Cotonti/blob/1.0.0/modules/users/inc/users.functions.php#L97 github.com: https://github.com/Cotonti/Cotonti/blob/1.0.0/modules/users/inc/users.profile.php#L116 github.com: https://github.com/Cotonti/Cotonti/blob/1.0.0/modules/users/inc/users.register.php#L148 github.com: https://github.com/Cotonti/Cotonti/pull/1905 vulncheck.com: https://www.vulncheck.com/advisories/cotonti-through-1.0.0-predictable-validation-tokens-via-md5-microtime
Credits
Sun Kimsroul