CVE-2026-121553 Details

A vulnerability in Cotonti versions through 1.0.0 allows for predictable validation tokens to be generated for registration and email-change processes. This is achieved by using md5 hashed microtime, which can be easily predicted and replicated. Attackers can derive the token generation time from the HTTP Date header, calculate potential tokens offline, and then submit these tokens to the validation handler to activate accounts or confirm email addresses they do not control.

To address this vulnerability, it is recommended to replace the token generation method with a more secure approach using a cryptographically secure random number generator. This can be done by creating a helper function that generates a secure token and using it in all relevant parts of the application.