CVE-2026-93868: Cotonti

High severity, CVSS 8.1. EPSS: 0.7% chance of exploitation in the next 30 days.

Cotonti through 1.0.0 derives password recovery validation tokens from md5(microtime()) in users.passrecover.php, creating a predictable token space of approximately one million values per second. Unauthenticated attackers can read the server Date header, precompute candidate tokens within a narrow time window, and probe them against the passrecover authentication endpoint to reset any account password including administrators.

Affected products

• Cotonti Cotonti: up to and including 1.0.0

Published 2026-09-18. Last modified 2026-09-22.