EUVD-2026-83365
GHSA-rw92-cwm5-wp25
Severity by source
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network attack (PR:N/UI:N) but success requires winning a timing race and brute-probing a large token space, so AC:H; admin account takeover yields full C:H/I:H/A:H.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Cotonti through 1.0.0 derives password recovery validation tokens from md5(microtime()) in users.passrecover.php, creating a predictable token space of approximately one million values per second. Unauthenticated attackers can read the server Date header, precompute candidate tokens within a narrow time window, and probe them against the passrecover authentication endpoint to reset any account password including administrators.
Articles & Coverage 1
AnalysisAI
Unauthenticated attackers can reset the password of any Cotonti account, including administrator accounts, because password-recovery validation tokens in Cotonti through 1.0.0 are derived from md5(microtime()) rather than a cryptographically secure random source, leaving roughly one million predictable candidate values per second. Exploitation requires the attacker to trigger the recovery flow for a target account, read the server's Date header to bootstrap the microtime() timing window, then precompute and probe candidate tokens against the passrecover endpoint before the seed drifts - a timing-constrained but fully unauthenticated attack (assessed CVSS 3.1 AV:N/AC:H/PR:N/UI:N, C:H/I:H/A:H; CVSS 4.0 base 9.2). …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target account's password-recovery flow be invoked (attacker can trigger it for any account, including admin) and that the attacker can read the server's Date header to bootstrap the microtime() timing window. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine high-priority flaw, not a CVSS-inflation case. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the upstream vendor fix, which replaces the predictable token generator in modules/users/inc/users.passrecover.php with $validationKey = bin2hex(random_bytes(32)) (256 bits of CSPRNG output) and corrects the $validationKey/$validationkey case mismatch that could bypass the empty-value check; the fix is delivered via the vendor's upstream pull request (https://github.com/Cotonti/Cotonti/pull/1898) referenced alongside the issue at https://github.com/Cotonti/Cotonti/issues/1890 and the VulnCheck advisory at https://www.vulncheck.com/advisories/cotonti-through-1.0.0-predictable-password-recovery-token-via-weak-prng - patch availability is confirmed per vendor, but a formally tagged patched release was not independently confirmed from the supplied data, so review the PR or advisory for the applicable distribution before relying on a release package, and backport the one-line change if no tag is yet published. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Cotonti installations and identify any running version 1.0.0 or earlier; apply the vendor patch for Cotonti, available per vendor advisory, to every affected instance, and if the patch cannot be applied immediately, disable or tightly restrict the password-recovery/passrecover endpoint and enforce aggressive rate limiting, short token lifetimes, and monitoring for reset abuse. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today