Predictable tokens in Cotonti let attackers bypass email verification
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · Low
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
Cotonti through 1.0.0 generates registration and email-change validation tokens from md5(microtime()), which makes them predictable (CWE-338). A remote, unauthenticated attacker can estimate the token generation time from the HTTP Date header, compute candidate tokens offline, and use them to activate accounts or confirm email addresses they do not control.
Written with Claude Haiku 5.5 from the sources below · 2026-11-07
Description from the CNA
Cotonti through 1.0.0 generates registration and email-change validation tokens with md5(microtime()), allowing attackers to bypass email-ownership verification by predicting tokens. Attackers can derive the generation time from the HTTP Date header and compute candidate tokens offline. They then submit these tokens to the users.register.php validate handler to activate accounts or confirm email addresses they do not control.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
The sources list no fixed version for Cotonti.
Written with Claude Haiku 5.5 from the sources below · 2026-11-07
Timeline
- 2026-11-03 Threatist record created from CVE-2026-121553
- 2026-11-03 Alias added: GHSA-gx42-rqfg-r6jm
- 2026-11-05 Priority changed: MEDIUM → LOW
- 2026-11-07 CISA SSVC decision points changed
- 2026-11-07 Priority changed: LOW → MEDIUM
References
Other 5
- GitHub Issue #1904
- https://github.com/Cotonti/Cotonti
- https://github.com/Cotonti/Cotonti/blob/1.0.0/modules/users/inc/users.functions.php#L97
- https://github.com/Cotonti/Cotonti/blob/1.0.0/modules/users/inc/users.profile.php#L116
- https://github.com/Cotonti/Cotonti/blob/1.0.0/modules/users/inc/users.register.php#L148
More Cotonti vulnerabilities
- TI-2026-62074 Cotonti 1.0.0 Comments Plugin PHP Object Injection via ci Parameter CVSS 4.0CRITICAL 9.3
- TI-2026-63195 Cotonti through 1.0.0 Predictable Password Recovery Token via Weak PRNG CVSS 4.0CRITICAL 9.2
- TI-2026-41862 Cotonti Siena 0.9.26 CSRF via admin.php Config Update Endpoint CVSS 4.0HIGH 8.7
- TI-2025-28591 A vulnerability has been found in Cotonti Siena v0.9.25. CVSS 3.1MEDIUM 5.4
- TI-2024-16007 A stored cross-site scripting (XSS) vulnerability in the Edit Page function of Cotonti… CVSS 3.1MEDIUM 5.4
- TI-2026-63200 Cotonti through 1.0.0 Cross-Site Request Forgery in the Contact Plugin CVSS 4.0MEDIUM 5.3
Sources
- CVE-2026-121553 · CVE Program
- CVE-2026-121553 · NVD
- FIRST EPSS
- GHSA-gx42-rqfg-r6jm · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences