---
id: CVE-2026-121553
title: Cotonti through 1.0.0 Predictable Validation Tokens via md5(microtime())
summary: >-
  Cotonti through 1.0.0 generates registration and email-change validation
  tokens with md5(microtime()), allowing attackers to bypass email-ownership
  verification by predicting tokens. Attackers can derive the generation time
  from the HTTP…
severity: medium
cvss: 4.8
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L'
cvssSource: cna
cwe:
  - CWE-338
vendor: cotonti
product: cotonti
affected:
  - cotonti <= 1.0.0
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-07T03:09:24.645106Z'
exploitAvailable: true
published: '2026-11-03'
updated: '2026-11-07'
sourceUpdated: '2026-11-07T03:09:49.080Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-121553'
references:
  - url: 'https://github.com/Cotonti/Cotonti/issues/1904'
    label: 'GitHub Issue #1904'
  - url: 'https://github.com/Cotonti/Cotonti'
  - url: >-
      https://github.com/Cotonti/Cotonti/blob/1.0.0/modules/users/inc/users.functions.php#L97
  - url: >-
      https://github.com/Cotonti/Cotonti/blob/1.0.0/modules/users/inc/users.profile.php#L116
  - url: >-
      https://github.com/Cotonti/Cotonti/blob/1.0.0/modules/users/inc/users.register.php#L148
  - url: 'https://github.com/Cotonti/Cotonti/pull/1905'
  - url: >-
      https://www.vulncheck.com/advisories/cotonti-through-1.0.0-predictable-validation-tokens-via-md5-microtime
    label: >-
      VulnCheck Advisory: Cotonti through 1.0.0 Predictable Validation Tokens
      via md5(microtime())
tags:
  - cve.org
  - exploit-available
epss: 0.00355
epssPercentile: 0.29414
ingestedAt: '2026-11-05T19:30:42.977Z'
---

## Overview

Cotonti through 1.0.0 generates registration and email-change validation tokens with md5(microtime()), allowing attackers to bypass email-ownership verification by predicting tokens. Attackers can derive the generation time from the HTTP Date header and compute candidate tokens offline. They then submit these tokens to the users.register.php validate handler to activate accounts or confirm email addresses they do not control.

## Affected

- `cotonti <= 1.0.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.