EUVD-2026-115898

Cotonti through 1.0.0 generates registration and email-change validation tokens with md5microtime, allowing attackers to bypass email-ownership verification by predicting tokens. Attackers can derive the generation time from the HTTP Date header and compute candidate tokens offline. They then...

CVE-2026-121553

Cotonti versions through 1.0.0 are vulnerable to predictable validation tokens due to the use of md5(microtime()) . An attacker can derive the generation time from the HTTP Date header to compute candidate tokens offline. This allows for bypassing email-ownership verification by submitting predic...

CVE-2026-121553: cotonti: Cotonti through 1.0.0 generates registration and email-change validation tokens with md5(microtime()), allowing…

Cotonti through 1.0.0 generates registration and email-change validation tokens with md5microtime, allowing attackers to bypass email-ownership verification by predicting tokens. Attackers can derive the generation time from the HTTP Date header and compute candidate tokens offline. They then...