CVE-2026-94107: NivoCart through 2.4.0 Predictable Administrator Password Reset Token
NivoCart through 2.4.0 contains a predictable password reset token vulnerability in the forgotten.php endpoint that generates recovery codes using substr(md5(mtrand()), 0, 10). Attackers who know an administrator's email address can request a password reset and predict the token to gain administrative account access without rate limiting or expiration.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
An attacker needs to know an administrator's email address and be able to submit a password-reset request to the forgotten.php endpoint. No existing account privileges or user interaction are required.
Are password-reset requests protected against repeated attempts or token aging?
No. The affected reset flow has no rate limiting and no expiration for recovery codes, allowing repeated attempts against a predicted token.
How can I determine whether my deployment is affected?
Deployments of NivoCart through version 2.4.0 are affected. Review the administrator password-reset implementation for recovery codes generated with substr(md5(mt_rand()), 0, 10) in the forgotten.php flow.