Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Overview Affected versions of this package are vulnerable to Use of Cryptographically Weak Pseudo-Random Number Generator PRNG via the users.passrecover.php process. An attacker can reset any account password, including administrators, by precomputing candidate tokens within a narrow time window...

CVE-2026-93868

Cotonti through 1.0.0 derives password recovery validation tokens from md5microtime in users.passrecover.php, creating a predictable token space of approximately one million values per second. Unauthenticated attackers can read the server Date header, precompute candidate tokens within a narrow...

EUVD-2026-83365

Cotonti through 1.0.0 derives password recovery validation tokens from md5microtime in users.passrecover.php, creating a predictable token space of approximately one million values per second. Unauthenticated attackers can read the server Date header, precompute candidate tokens within a narrow...

CVE-2026-93868 Cotonti through 1.0.0 Predictable Password Recovery Token via Weak PRNG

Cotonti through 1.0.0 derives password recovery validation tokens from md5microtime in users.passrecover.php, creating a predictable token space of approximately one million values per second. Unauthenticated attackers can read the server Date header, precompute candidate tokens within a narrow...

CVE-2026-93868

Cotonti through 1.0.0 uses md5(microtime()) to generate password recovery validation tokens in users.passrecover.php, yielding a predictable token space of roughly one million values per second. An unauthenticated attacker can read the server Date header, precompute candidate tokens within a narr...

PT-2026-95699

Name of the Vulnerable Software and Affected Versions Cotonti version 1.0.0 Description Password recovery validation tokens are derived from md5microtime within the users.passrecover.php file, resulting in a predictable token space of approximately one million values per second. Unauthenticated...

CVE-2026-93868: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Cotonti through 1.0.0 derives password recovery validation tokens from md5microtime in users.passrecover.php, creating a predictable token space of approximately one million values per second. Unauthenticated attackers can read the server Date header, precompute candidate tokens within a narrow...