CVE-2026-121450: CFNext before 3.1.0 Admin Password Recovery via MD5-Derived Subscription UUID

Published Nov 3, 2026

Updated

CFNext before 3.1.0 contains a weak cryptographic derivation vulnerability that allows subscription link holders to recover the admin password because the subscription UUID is an MD5 of the password with a fixed public salt. Attackers can brute-force the password offline without rate limiting, log into the admin panel, and read stored Trojan, Clash, Telegram and Cloudflare API secrets.

Event History

Nov 3, 2026

CVE Published

via MITRE·03:17 PM

Data Sourced

via MITRE·03:17 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·04:17 PM

DescriptionSeverityWeakness

Event

via NVD·04:17 PM

Frequently Asked Questions

Who is exposed to this issue?

CFNext deployments before 3.1.0 are exposed when an attacker holds a subscription link. The link provides a subscription UUID derived from the admin password, enabling offline password guessing.

What does an attacker need to exploit it?

The attacker needs a subscription link containing the subscription UUID. They do not need to interact with a rate-limited login process because password guesses can be tested offline.

What can an attacker access after recovering the password?

A recovered password allows login to the admin panel. From there, an attacker can read stored Trojan, Clash, Telegram, and Cloudflare API secrets.

CVE-2026-121450: CFNext before 3.1.0 Admin Password Recovery via MD5-Derived Subscription UUID

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What can an attacker access after recovering the password?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What can an attacker access after recovering the password?