{"id":"CVE-2026-93868","title":"Cotonti through 1.0.0 derives password recovery validation tokens from md5(microtime()) in users.passrecover.php, creating a predictable token space of approximately one million values per second","summary":"Cotonti through 1.0.0 derives password recovery validation tokens from md5(microtime()) in users.passrecover.php, creating a predictable token space of approximately one million values per second. Unauthenticated attackers can read the s…","severity":"high","cvss":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-338"],"vendor":"Cotonti","product":"Cotonti","affected":["Cotonti <= 1.0.0"],"published":"2026-09-18","updated":"2026-09-18","sourceUpdated":"2026-09-18T21:18:49.023","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-93868","references":[{"url":"https://github.com/Cotonti/Cotonti","label":"disclosure@vulncheck.com"},{"url":"https://github.com/Cotonti/Cotonti/blob/1.0.0/modules/users/inc/users.passrecover.php","label":"disclosure@vulncheck.com"},{"url":"https://github.com/Cotonti/Cotonti/issues/1890","label":"disclosure@vulncheck.com"},{"url":"https://github.com/Cotonti/Cotonti/pull/1898","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/cotonti-through-1.0.0-predictable-password-recovery-token-via-weak-prng","label":"disclosure@vulncheck.com"},{"url":"https://github.com/Cotonti/Cotonti/issues/1890","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd","cve.org","exploit-available"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"total","timestamp":"2026-09-18T20:19:56.767733Z"},"ingestedAt":"2026-09-18T20:51:25.688Z","epss":0.00607,"epssPercentile":0.47431,"slug":"CVE-2026-93868","body":"## Overview\n\nCotonti through 1.0.0 derives password recovery validation tokens from md5(microtime()) in users.passrecover.php, creating a predictable token space of approximately one million values per second. Unauthenticated attackers can read the server Date header, precompute candidate tokens within a narrow time window, and probe them against the passrecover authentication endpoint to reset any account password including administrators.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":57,"depthScoreParts":{"impact":44.6,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[]}