Vulnerability · Published Nov 3, 2026 · Assigned by VulnCheck
CVE-2026-121450CFNext before 3.1.0 Admin Password Recovery via MD5-Derived Subscription UUID
High 7.5
In plain English
A high-severity security flaw in CFNext from PAICNI. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 18% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.3%top 82.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
CFNext before 3.1.0 contains a weak cryptographic derivation vulnerability that allows subscription link holders to recover the admin password because the subscription UUID is an MD5 of the password with a fixed public salt. Attackers can brute-force the password offline without rate limiting, log into the admin panel, and read stored Trojan, Clash, Telegram and Cloudflare API secrets.
Affected products (as reported)
Weakness: CWE-760 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- GitHub Issue #57 issue-tracking
- https://github.com/PAICNI/CFNext product
- Fix commit patch
- https://github.com/PAICNI/CFNext/blob/1c7b3d8bed5b06a1449ea28302bb9a648f67e8e1/CFNext-%E6%98%8E%E6%96%87%E7%89%88.js#L12 technical-description
- https://github.com/PAICNI/CFNext/blob/1c7b3d8bed5b06a1449ea28302bb9a648f67e8e1/CFNext-%E6%98%8E%E6%96%87%E7%89%88.js#L2440 technical-description
- VulnCheck Advisory: CFNext before 3.1.0 Admin Password Recovery via MD5-Derived Subscription UUID third-party-advisory