CFNext CVE-2026-121450

The attacker must already possess a valid CFNext subscription link, from which the subscription UUID - an MD5 of the admin password with a fixed, publicly known salt - can be read; this corresponds to PR:L. The admin password is then recovered via an offline brute-force that the application does not rate-limit. Exploitation is limited by three factors: possession of a subscription link is required (not fully anonymous), the offline brute-force only succeeds if the admin password is weak enough to crack (reflected in AC:H), and only CFNext versions before 3.1.0 are affected. No user interaction is needed once the UUID is held.

The vendor CVSS 4.0 base score is 7.7 (High), driven by full confidentiality, integrity and availability impact on the vulnerable system (VC:H/VI:H/VA:H) once the admin panel is reached. Two signals temper the raw severity: AC:H reflects that password recovery requires an offline brute-force whose success depends on the admin password's strength, and PR:L means the attacker must already hold a valid subscription link rather than being fully anonymous. The vuln.today decision label is 'this_week' (not act_now/emergency), consistent with a serious-but-not-crisis prioritization. No EPSS score and no CISA KEV entry were provided, so there is no evidence of active or widespread exploitation, and no verified public exploit code was supplied - meaning this should be treated as a credible, patch-this-week issue rather than an emergency. Key missing data: EPSS exploitation probability is absent, and KEV status is not indicated (treated as not listed). The main risk amplifier is the sensitivity of what the admin panel exposes - stored Trojan, Clash, Telegram and Cloudflare API secrets - so successful exploitation yields high-value credential disclosure even though the entry barrier (holding a subscription link plus crackable password) limits the attacker population.

An attacker who has been issued a CFNext subscription link (e.g. a low-trust subscriber) extracts the subscription UUID, which is an MD5 of the admin password computed with a fixed public salt, and runs an unrate-limited offline brute-force to recover the plaintext admin password. They then log into the admin panel and read the stored Trojan, Clash, Telegram and Cloudflare API secrets. No verified public exploit code was provided, though a VulnCheck advisory and a GitHub disclosure issue (#57) exist; the high attack complexity means success hinges on the admin password being weak enough to crack.