Live › vulnerability › CVE-2026-121450
CFNext before 3.1.0 derives each subscription UUID as an MD5 of the admin password using a fixed public salt. Anyone holding a subscription link can brute-force the password offline without rate limits, then log into the admin panel and read stored Trojan, Clash, Telegram and Cloudflare API secrets.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 16:21 UTC. All times on this page are UTC.
Teams that run CFNext before 3.1.0 and hand out subscription links to users. Anyone holding a subscription link can attempt to recover the admin password, so the link itself is the attack surface. Deployments that never shared subscription links are less exposed.
No product ranges from the sources yet.
3.1.0 are in scope.3.1.0 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
CFNext before 3.1.0 contains a weak cryptographic derivation vulnerability that allows subscription link holders to recover the admin password because the subscription UUID is an MD5 of the password with a fixed public salt. Attackers can brute-force the password offline without rate limiting, log into the admin panel, and read stored Trojan, Clash, Telegram and Cloudflare API secrets.
This page as .md · .json · in your agent: get_signal("CVE-2026-121450")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.