{"id":"CVE-2026-121450","title":"CFNext before 3.1.0 Admin Password Recovery via MD5-Derived Subscription UUID","summary":"CFNext before 3.1.0 contains a weak cryptographic derivation vulnerability that allows subscription link holders to recover the admin password because the subscription UUID is an MD5 of the password with a fixed public salt. Attackers ca…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-760"],"vendor":"PAICNI","product":"CFNext","affected":["CFNext < 3.1.0"],"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"total","timestamp":"2026-11-07T03:04:46.618315Z"},"exploitAvailable":true,"published":"2026-11-03","updated":"2026-11-07","sourceUpdated":"2026-11-07T03:05:12.466Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-121450","references":[{"url":"https://github.com/PAICNI/CFNext/issues/57","label":"GitHub Issue #57"},{"url":"https://github.com/PAICNI/CFNext"},{"url":"https://github.com/PAICNI/CFNext/commit/ca8ad82bb7c635f765c82a1cd0c954fd70d81fb7","label":"Fix commit"},{"url":"https://github.com/PAICNI/CFNext/blob/1c7b3d8bed5b06a1449ea28302bb9a648f67e8e1/CFNext-%E6%98%8E%E6%96%87%E7%89%88.js#L12"},{"url":"https://github.com/PAICNI/CFNext/blob/1c7b3d8bed5b06a1449ea28302bb9a648f67e8e1/CFNext-%E6%98%8E%E6%96%87%E7%89%88.js#L2440"},{"url":"https://www.vulncheck.com/advisories/cfnext-before-3.1.0-admin-password-recovery-via-md5-derived-subscription-uuid","label":"VulnCheck Advisory: CFNext before 3.1.0 Admin Password Recovery via MD5-Derived Subscription UUID"}],"tags":["cve.org","exploit-available"],"epss":0.0026,"epssPercentile":0.17871,"ingestedAt":"2026-11-05T19:30:42.976Z","slug":"CVE-2026-121450","body":"## Overview\n\nCFNext before 3.1.0 contains a weak cryptographic derivation vulnerability that allows subscription link holders to recover the admin password because the subscription UUID is an MD5 of the password with a fixed public salt. Attackers can brute-force the password offline without rate limiting, log into the admin panel, and read stored Trojan, Clash, Telegram and Cloudflare API secrets.\n\n## Affected\n\n- `CFNext < 3.1.0`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":53,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":235767,"id":"CVE-2026-121450","ts":1794024607056,"field":"exploit_available","old":"false","new":"true"}]}