CVE-2026-93868: Cotonti through 1.0.0 Predictable Password Recovery Token via Weak PRNG
Cotonti through 1.0.0 derives password recovery validation tokens from md5(microtime()) in users.passrecover.php, creating a predictable token space of approximately one million values per second. Unauthenticated attackers can read the server Date header, precompute candidate tokens within a narrow time window, and probe them against the passrecover authentication endpoint to reset any account password including administrators.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An unauthenticated remote attacker can exploit it. The attacker can use the server's HTTP Date header to narrow the token-generation time window, precompute candidate recovery tokens, and submit them to the password-recovery authentication endpoint.
Are administrator accounts exposed?
Yes. Successful token prediction can allow an attacker to reset the password of any account, including administrator accounts.
What versions are affected?
Cotonti through version 1.0.0 is affected.