CVE-2026-93868 Details
Description
Cotonti through 1.0.0 derives password recovery validation tokens from md5(microtime()) in users.passrecover.php, creating a predictable token space of approximately one million values per second. Unauthenticated attackers can read the server Date header, precompute candidate tokens within a narrow time window, and probe them against the passrecover authentication endpoint to reset any account password including administrators.
A vulnerability in Cotonti versions through 1.0.0 allows for predictable password recovery tokens, derived from md5(microtime()), to be exploited by unauthenticated attackers. The issue is located in the password recovery module's authentication endpoint. Attackers can read the server Date header to time their requests, precompute token candidates, and reset passwords for any user, including administrators.
Replace the token generation method to use a cryptographically secure random number generator (CSPRNG) and fix the variable name in the password recovery script.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 18, 2026CISA-ADP
Assessed Sep 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/Cotonti/Cotonti/issues/1890 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/Cotonti/Cotonti | [email protected] | Vendor |
| https://github.com/Cotonti/Cotonti/blob/1.0.0/modules/users/inc/users.passrecover.php | [email protected] | Source CodeVendor |
| https://github.com/Cotonti/Cotonti/issues/1890 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/Cotonti/Cotonti/pull/1898 | [email protected] | Source CodeVendor |
| https://www.vulncheck.com/advisories/cotonti-through-1.0.0-predictable-password-recovery-token-via-weak-prng | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-338 | Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Cotonti | <= 1.0.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 18, 2026 | CVE Modified | CISA-ADP |
| Sep 18, 2026 | New CVE Received | [email protected] |