---
id: CVE-2026-121450
title: CFNext before 3.1.0 Admin Password Recovery via MD5-Derived Subscription UUID
summary: >-
  CFNext before 3.1.0 contains a weak cryptographic derivation vulnerability
  that allows subscription link holders to recover the admin password because
  the subscription UUID is an MD5 of the password with a fixed public salt.
  Attackers ca…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-760
vendor: PAICNI
product: CFNext
affected:
  - CFNext < 3.1.0
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-11-07T03:04:46.618315Z'
exploitAvailable: true
published: '2026-11-03'
updated: '2026-11-07'
sourceUpdated: '2026-11-07T03:05:12.466Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-121450'
references:
  - url: 'https://github.com/PAICNI/CFNext/issues/57'
    label: 'GitHub Issue #57'
  - url: 'https://github.com/PAICNI/CFNext'
  - url: >-
      https://github.com/PAICNI/CFNext/commit/ca8ad82bb7c635f765c82a1cd0c954fd70d81fb7
    label: Fix commit
  - url: >-
      https://github.com/PAICNI/CFNext/blob/1c7b3d8bed5b06a1449ea28302bb9a648f67e8e1/CFNext-%E6%98%8E%E6%96%87%E7%89%88.js#L12
  - url: >-
      https://github.com/PAICNI/CFNext/blob/1c7b3d8bed5b06a1449ea28302bb9a648f67e8e1/CFNext-%E6%98%8E%E6%96%87%E7%89%88.js#L2440
  - url: >-
      https://www.vulncheck.com/advisories/cfnext-before-3.1.0-admin-password-recovery-via-md5-derived-subscription-uuid
    label: >-
      VulnCheck Advisory: CFNext before 3.1.0 Admin Password Recovery via
      MD5-Derived Subscription UUID
tags:
  - cve.org
  - exploit-available
epss: 0.0026
epssPercentile: 0.17871
ingestedAt: '2026-11-05T19:30:42.976Z'
---

## Overview

CFNext before 3.1.0 contains a weak cryptographic derivation vulnerability that allows subscription link holders to recover the admin password because the subscription UUID is an MD5 of the password with a fixed public salt. Attackers can brute-force the password offline without rate limiting, log into the admin panel, and read stored Trojan, Clash, Telegram and Cloudflare API secrets.

## Affected

- `CFNext < 3.1.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.