Cotonti CMS CVE-2026-121553

Exploitation requires that the target Cotonti instance (through 1.0.0) exposes the registration or email-change validation flow and that the attacker can initiate a token-generating action (registration or email-change) tied to an address they wish to seize. The concrete prerequisite is reconstructing the md5(microtime()) input: the attacker uses the HTTP Date header to fix the whole-second timestamp and must brute-force the sub-second microtime component (roughly one million candidates per targeted second) offline, then replay matching 32-character tokens to the users.register.php validate handler. Limiting factors: the AC:H microsecond-guessing requirement bounds reliability and scale, success depends on timing the request against the server clock, and the only complete fix is upgrading past 1.0.0 to a build containing PR #1905's CSPRNG token generator.

This is a medium-severity authentication-bypass flaw rated CVSS 4.0 6.3 (AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L). The network vector with no privileges or user interaction makes it remotely reachable against any internet-facing Cotonti instance, but AC:H is the decisive limiter: the attacker must correctly guess the microsecond component of microtime() used as md5() input. Because the HTTP Date header reveals the whole-second value, the keyspace collapses to roughly one million candidates per targeted second, which is computable offline but still non-trivial and not reliably automatable at scale. No EPSS score was supplied and the CVE is not on the CISA KEV list; no public exploit was identified at time of analysis - only a VulnCheck advisory and the upstream issue/PR. The vuln.today decision label is 'this_month', not act_now or emergency, which is consistent with a real but non-urgent integrity issue rather than mass-exploited RCE. Net judgment: a genuine, patch-worthy weakness (predictable CSPRNG, CWE-338) with limited blast radius and a guessing cost that argues for scheduled patching rather than crisis response. Note the input vector assigns VA:L (availability), but the described impact - bypassing email-ownership verification to activate accounts or confirm addresses - is an integrity effect; the availability rating is not clearly supported by the description.

An attacker initiates a registration or email-change for an address they do not control, then reads the server's HTTP Date header to learn the whole-second timestamp when the md5(microtime()) validation token was generated. They compute the ~1,000,000 candidate tokens for that second offline and submit them to the users.register.php validate handler until one is accepted, activating the account or confirming the email. No KEV listing and no public exploit code were identified; feasibility is bounded by the AC:H microsecond-guessing requirement.