Dashboard / CVE-2026-121553

CVE-2026-121553

MEDIUM
MEDIUM Priority: 0.02 BB Relevance: 73/100
Published: 2026-11-03 Modified: 2026-11-07 First seen: 2026-11-03 Status: active

Attack Surface

Network Low Complexity No Auth No Interaction

CVSS Vector Breakdown

AV: Network
AC: High
PR: None
UI: None
S: X
AT: None
VC: None
VI: Low
VA: Low

Description

Cotonti through 1.0.0 generates registration and email-change validation tokens with md5(microtime()), allowing attackers to bypass email-ownership verification by predicting tokens. Attackers can derive the generation time from the HTTP Date header and compute candidate tokens offline. They then submit these tokens to the users.register.php validate handler to activate accounts or confirm email addresses they do not control.

Weakness Classification (1)

Affected Software (2)

VendorProductVersion
cotonti cotonti 0
cotonti cotonti 0

References & Advisories (7)

https://github.com/Cotonti/Cotonti/pull/1905
technical-description patch issue-tracking

Bug Bounty Relevance

73 / 100
✓ Network accessible
✓ No authentication
✓ Low complexity
✓ No user interaction

CVSS Score

6.3 / 10.0 v4.0
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

EPSS — Exploitation Probability

0.36%
Raw Score 0.003550
Percentile 29.7%
Date 2026-11-14

EPSS Trend

2026-11-14
0.00355
2026-11-13
0.00355
2026-11-12
0.00355
2026-11-10
0.00355
2026-11-09
0.00355
2026-11-08
0.00355
2026-11-07
0.00355
2026-11-06
0.00355
2026-11-05
0.00355
2026-11-04
0.00355

Intelligence Sources

mitre ref →
nvd ref →

External Links