CVE-2026-94107 Details

A vulnerability exists in NivoCart versions through 2.4.0, specifically in the forgotten.php endpoint, where password reset tokens are generated using a predictable method. The tokens are created by taking a substring of the MD5 hash of a random number generated by mt_rand, resulting in low entropy and predictability. This flaw allows attackers who know an administrator's email address to anticipate the reset token and gain unauthorized access to the administrative account. The vulnerability is exacerbated by the absence of rate limiting or expiration for the tokens.

To address this vulnerability, NivoCart should implement a more secure method of generating password reset tokens, such as using cryptographically secure random number generation. Additionally, tokens should be bound to an expiration timestamp and invalidated after a set period. It is also recommended to apply rate limiting to the password reset request and token redemption processes.