Vulnerability · Published Nov 3, 2026 · Assigned by VulnCheck

CVE-2026-121553Cotonti through 1.0.0 Predictable Validation Tokens via md5(microtime())

Medium 4.8

In plain English

A medium-severity security flaw in cotonti from cotonti. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).

Severity (CVSS 3.1)4.8Medium

Exploit odds (30 days)0.4%top 70.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Cotonti through 1.0.0 generates registration and email-change validation tokens with md5(microtime()), allowing attackers to bypass email-ownership verification by predicting tokens. Attackers can derive the generation time from the HTTP Date header and compute candidate tokens offline. They then submit these tokens to the users.register.php validate handler to activate accounts or confirm email addresses they do not control.

Affected products (as reported)

Vendor	Product	Versions
cotonti	cotonti	0 – through 1.0.0

Weakness: CWE-338 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L

References

GitHub Issue #1904 issue-tracking
https://github.com/Cotonti/Cotonti product
https://github.com/Cotonti/Cotonti/blob/1.0.0/modules/users/inc/users.functions.php#L97 technical-description
https://github.com/Cotonti/Cotonti/blob/1.0.0/modules/users/inc/users.profile.php#L116 technical-description
https://github.com/Cotonti/Cotonti/blob/1.0.0/modules/users/inc/users.register.php#L148 technical-description
https://github.com/Cotonti/Cotonti/pull/1905 technical-description, patch, issue-tracking
VulnCheck Advisory: Cotonti through 1.0.0 Predictable Validation Tokens via md5(microtime()) third-party-advisory