Cfnext
Monthly
Offline recovery of the CFNext admin password allows anyone holding a valid subscription link to take over the admin panel and read stored Trojan, Clash, Telegram and Cloudflare API secrets in all versions before 3.1.0. The subscription UUID is an MD5 hash of the admin password combined with a fixed, publicly known salt, so the UUID functions as an offline password verifier that can be attacked with unlimited guesses because no rate limiting applies. Exploitation is constrained: the attacker must first obtain a subscription link, and the brute-force only succeeds against an admin password weak enough to crack; no public exploit code was identified at time of analysis, and a vendor fix exists in CFNext 3.1.0 (commit ca8ad82).
Offline recovery of the CFNext admin password allows anyone holding a valid subscription link to take over the admin panel and read stored Trojan, Clash, Telegram and Cloudflare API secrets in all versions before 3.1.0. The subscription UUID is an MD5 hash of the admin password combined with a fixed, publicly known salt, so the UUID functions as an offline password verifier that can be attacked with unlimited guesses because no rate limiting applies. Exploitation is constrained: the attacker must first obtain a subscription link, and the brute-force only succeeds against an admin password weak enough to crack; no public exploit code was identified at time of analysis, and a vendor fix exists in CFNext 3.1.0 (commit ca8ad82).