Cotonti CVE-2026-93868

Exploitation requires that the target account's password-recovery flow be invoked (attacker can trigger it for any account, including admin) and that the attacker can read the server's Date header to bootstrap the microtime() timing window. The limiting factor is timing: the attacker must precompute and probe candidate tokens within the narrow window before the token seed drifts, and must succeed against the ~1M-value/second space (reflected as AC:H/AT:P). No authentication, no user interaction, and no special server configuration are needed - the weak md5(microtime()) token generation is the default behavior in Cotonti through 1.0.0. Any endpoint rate-limiting or short token TTL would further constrain the probing step.

This is a genuine high-priority flaw, not a CVSS-inflation case. The impact is complete account takeover of any user including administrators via an unauthenticated network path (PR:N/UI:N), which correctly justifies full VC:H/VI:H/VA:H. The tempering factors are real and well-modeled by the vendor's CVSS 4.0 vector: AC:H and AT:P (attack requirements present) reflect that success is not deterministic - the attacker must win a race against a narrow time window, precompute the correct md5(microtime()) candidate, and probe it before the token expires or the window drifts. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active exploitation - the signal here is a credible reported flaw with a vendor patch, reported by VulnCheck, rather than in-the-wild abuse. Net: treat as a priority patch for any Cotonti operator because the impact is total (admin takeover) and unauthenticated, but the low deployment footprint and probabilistic timing requirement mean opportunistic mass exploitation is less likely than targeted attacks against known Cotonti sites.

An unauthenticated attacker targeting a known Cotonti site issues a password-recovery request for the admin account, then reads the server's HTTP Date header to anchor the microtime() seed. They precompute the ~1 million candidate md5(microtime()) tokens for the relevant second and rapidly probe them against the passrecover endpoint until one validates, allowing them to reset the admin password and seize the account. No public exploit code was identified at time of analysis, though the technique is fully described in the VulnCheck advisory.