---
id: "CVE-2026-121553"
kind: "vulnerability"
aliases: ["CVE-2026-121553"]
title: "Cotonti: predictable email tokens let attackers take over unverified accounts"
severity: "medium"
cvss: 6.3
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["cotonti", "php", "runtime", "self-hosted"]
not_affected_if: ["registration-disabled"]
published_at: "2026-11-03T16:17:27+00:00"
first_seen_at: "2026-11-03T16:21:44+00:00"
updated_at: "2026-11-03T16:24:09+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-121553", "first_seen_at": "2026-11-03T16:21:44+00:00"}]
---

# Cotonti: predictable email tokens let attackers take over unverified accounts

Cotonti through 1.0.0 builds registration and email-change validation tokens from md5(microtime()), so the token can be guessed once the time is known. An attacker can submit a guessed token to the validation handler to activate accounts or confirm email addresses they do not own.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Cotonti version; the sources say versions through 1.0.0 are affected.
- Look for the token generation code that calls `md5(microtime())` in the registration and email-change code paths.

## Timeline

- 2026-11-03T16:21:44+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-121553

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/cotonti-through-1.0.0-predictable-validation-tokens-via-md5-microtime

## From the sources

Cotonti through 1.0.0 generates registration and email-change validation tokens with md5(microtime()), allowing attackers to bypass email-ownership verification by predicting tokens. Attackers can derive the generation time from the HTTP Date header and compute candidate tokens offline. They then submit these tokens to the users.register.php validate handler to activate accounts or confirm email addresses they do not control.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_