CVE-2026-121553

Cotonti versions through 1.0.0 are vulnerable to predictable validation tokens due to the use of md5(microtime()) . An attacker can derive the generation time from the HTTP Date header to compute candidate tokens offline. This allows for bypassing email-ownership verification by submitting predic...