Executive brief
Cotonti, a PHP content management framework, generates password recovery tokens using a predictable method based on the server's current time. An attacker can read the server's time from HTTP headers, calculate likely token values, and use them to reset any user's password including administrators without authentication, gaining complete control of the system.
Technical details
The vulnerability exists in users.passrecover.php where password recovery validation tokens are derived from md5(microtime()), creating only ~1 million possible values per second. An unauthenticated attacker can observe the server Date header to narrow the time window, precompute candidate tokens, and brute-force the passrecover endpoint to reset arbitrary account passwords. No authentication or user interaction is required.
Affected products
- Cotonti Cotonti through 1.0.0
Timeline
- 2026-09-18: disclosed