CFNext vulnerabilities

CVEs whose affected-version data names the CFNext package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-121450High· 7.5PoC

5d ago

CFNext before 3.1.0 Admin Password Recovery via MD5-Derived Subscription UUID

CFNext before 3.1.0 contains a weak cryptographic derivation vulnerability that allows subscription link holders to recover the admin password because the subscription UUID is an MD5 of the password with a fixed public salt. Attackers ca…

▾ MidnightPAICNI · CFNextEPSS 0.26%via CVEORG