{"id":"CVE-2026-121553","kind":"vulnerability","aliases":["CVE-2026-121553"],"related":[],"title":"Cotonti: predictable email tokens let attackers take over unverified accounts","description":"Cotonti through 1.0.0 generates registration and email-change validation tokens with md5(microtime()), allowing attackers to bypass email-ownership verification by predicting tokens. Attackers can derive the generation time from the HTTP Date header and compute candidate tokens offline. They then submit these tokens to the users.register.php validate handler to activate accounts or confirm email addresses they do not control.","summary":"Cotonti through 1.0.0 builds registration and email-change validation tokens from md5(microtime()), so the token can be guessed once the time is known. An attacker can submit a guessed token to the validation handler to activate accounts or confirm email addresses they do not own.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cotonti","php","runtime","self-hosted"],"not_affected_if":["registration-disabled"],"how_to_check":"- Check the installed Cotonti version; the sources say versions through 1.0.0 are affected.\n- Look for the token generation code that calls `md5(microtime())` in the registration and email-change code paths.","fix":null,"status":"open","published_at":"2026-11-03T16:17:27+00:00","first_seen_at":"2026-11-03T16:21:44+00:00","triaged_at":"2026-11-03T16:24:09+00:00","updated_at":"2026-11-03T16:24:09+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-11-03T16:24:09Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Cotonti: predictable email tokens let attackers take over unverified accounts","impact":"medium","summary":"Cotonti through 1.0.0 builds registration and email-change validation tokens from md5(microtime()), so the token can be guessed once the time is known. An attacker can submit a guessed token to the validation handler to activate accounts or confirm email addresses they do not own.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["cotonti","php","self-hosted"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"attacker activates accounts and takes over email-linked accounts","analyst_note":"Confirm the fixed version and whether any patch exists; check the vulncheck advisory linked in the sources.","how_to_check":"- Check the installed Cotonti version; the sources say versions through 1.0.0 are affected.\n- Look for the token generation code that calls `md5(microtime())` in the registration and email-change code paths.\n- unknown for any other check; the sources do not say.","plain_action":"","needs_analyst":true,"not_affected_if":["registration-disabled"],"who_is_affected":"Sites running Cotonti 1.0.0 or earlier that allow self-registration or email changes are exposed, because account activation relies on the predictable token. Sites with registration disabled or with no email-change flow can skip it. The sources do not describe further conditions.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000688,"input_tokens":4178,"output_tokens":540,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-121553':13A,16A '-2026':12A,15A '1.0.0':25B,68C 'account':10A,61B,119C 'activ':60B,118C 'address':65B,123C 'allow':80C 'attack':6A,49B,81C,91C 'build':26B 'bypass':83C 'candid':104C 'chang':31B,74C 'comput':103C 'confirm':63B,121C 'control':127C 'cotonti':1A,17B,23B,66C 'cve':11A,14A 'date':100C 'deriv':93C 'email':3A,30B,64B,73C,85C,122C 'email-chang':29B,72C 'email-ownership':84C 'generat':69C,95C 'guess':42B,53B 'handler':58B,116C 'header':101C 'host':22B 'http':99C 'known':47B 'let':5A 'md5':35B,78C 'microtim':36B,79C 'offlin':106C 'ownership':86C 'php':18B 'predict':2A,89C 'registr':27B,70C 'runtim':19B 'self':21B 'self-host':20B 'submit':51B,109C 'take':7A 'time':45B,96C 'token':4A,33B,39B,54B,76C,90C,105C,111C 'unverifi':9A 'users.register.php':114C 'valid':32B,57B,75C,115C 'verif':87C","nicknames":[],"mitigations":[],"who_affected":"Sites running Cotonti 1.0.0 or earlier that allow self-registration or email changes are exposed, because account activation relies on the predictable token. Sites with registration disabled or with no email-change flow can skip it. The sources do not describe further conditions.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["cotonti","medium","php","runtime","selfhosted"],"campaign_type":null,"first_public_at":"2026-11-03T16:17:27+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-121553","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121553","severity":null,"published_at":"2026-11-03T16:17:27+00:00","modified_at":"2026-11-03T16:17:27+00:00","first_seen_at":"2026-11-03T16:21:44+00:00","fetched_at":"2026-11-03T16:21:44+00:00","note":null}],"documents":[{"id":58842,"url":"https://www.vulncheck.com/advisories/cotonti-through-1.0.0-predictable-validation-tokens-via-md5-microtime","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}