CVE-2026-121553
Deferred Deferred - Pending Action

Cotonti Registration Token Prediction via MD5 Microtime

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: VulnCheck

Description
Cotonti through 1.0.0 generates registration and email-change validation tokens with md5(microtime()), allowing attackers to bypass email-ownership verification by predicting tokens. Attackers can derive the generation time from the HTTP Date header and compute candidate tokens offline. They then submit these tokens to the users.register.php validate handler to activate accounts or confirm email addresses they do not control.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-121553
EUVD
EUVD-2026-115898

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
cotonti cotonti 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-338 The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-121553 is a vulnerability in Cotonti, a content management system, where registration and email-change validation tokens are generated using md5(microtime()). This creates predictable tokens because the generation time can be derived from the HTTP Date header. Attackers can compute candidate tokens offline and submit them to bypass email-ownership verification, allowing unauthorized account activation or email changes.

Detection Guidance

Check Cotonti version with: grep -r "version" /path/to/cotonti/ | grep Cotonti. If version <= 1.0.0, the system is vulnerable. Inspect token generation in users.register.php, users.profile.php, and users.passrecover.php for md5(microtime()) usage.

Impact Analysis

This vulnerability allows attackers to take over accounts by predicting validation tokens. They can activate accounts or change email addresses without control, leading to unauthorized access. Attackers can also reset passwords for accounts that have changed emails or recently registered, including administrators. The impact includes account takeover, data manipulation, and potential privilege escalation.

Compliance Impact

This vulnerability likely violates compliance requirements for data protection and security. GDPR mandates strong authentication and protection against unauthorized access. HIPAA requires safeguards for sensitive data. The lack of secure token generation could lead to unauthorized access, breaching confidentiality and integrity requirements under these regulations.

Mitigation Strategies

Upgrade Cotonti to the latest version where tokens are generated using CSPRNG like bin2hex(random_bytes(16)). If upgrading is not possible, manually replace md5(microtime()) with a secure token generator in users.register.php, users.profile.php, and users.passrecover.php.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-121553. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...