Live › vulnerability › CVE-2026-121553
Cotonti through 1.0.0 builds registration and email-change validation tokens from md5(microtime()), so the token can be guessed once the time is known. An attacker can submit a guessed token to the validation handler to activate accounts or confirm email addresses they do not own.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 16:21 UTC. All times on this page are UTC.
Sites running Cotonti 1.0.0 or earlier that allow self-registration or email changes are exposed, because account activation relies on the predictable token. Sites with registration disabled or with no email-change flow can skip it. The sources do not describe further conditions.
No product ranges from the sources yet.
md5(microtime()) in the registration and email-change code paths.No fix yet, per the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Cotonti through 1.0.0 generates registration and email-change validation tokens with md5(microtime()), allowing attackers to bypass email-ownership verification by predicting tokens. Attackers can derive the generation time from the HTTP Date header and compute candidate tokens offline. They then submit these tokens to the users.register.php validate handler to activate accounts or confirm email addresses they do not control.
This page as .md · .json · in your agent: get_signal("CVE-2026-121553")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.