EUVD-2026-115898

Cotonti through 1.0.0 generates registration and email-change validation tokens with md5microtime, allowing attackers to bypass email-ownership verification by predicting tokens. Attackers can derive the generation time from the HTTP Date header and compute candidate tokens offline. They then...