CVE-2026-93868

EUVD-2026-83365
Cotonti through 1.0.0 derives password recovery validation tokens from md5(microtime()) in users.passrecover.php, creating a predictable token space of approximately one million values per second. Unauthenticated attackers can read the server Date header, precompute candidate tokens within a narrow time window, and probe them against the passrecover authentication endpoint to reset any account password including administrators.
PRNG
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.1 HIGH
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/Cotonti/Cotonti
https://github.com/Cotonti/Cotonti/blob/1.0.0/modules/users/inc/users.passrecover.php
https://github.com/Cotonti/Cotonti/issues/1890
https://github.com/Cotonti/Cotonti/pull/1898
https://www.vulncheck.com/advisories/cotonti-through-1.0.0-predictable-password-recovery-token-via-weak-prng
https://github.com/Cotonti/Cotonti/issues/1890