Description
Cotonti through 1.0.0 derives password recovery validation tokens from md5(microtime()) in users.passrecover.php, creating a predictable token space of approximately one million values per second. Unauthenticated attackers can read the server Date header, precompute candidate tokens within a narrow time window, and probe them against the passrecover authentication endpoint to reset any account password including administrators.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Cotonti | Cotonti | ≤ 1.0.0 | — |
References
- https://github.com/Cotonti/Cotonti/issues/1890 issue-tracking
- https://github.com/Cotonti/Cotonti/pull/1898 patch issue-tracking
- https://github.com/Cotonti/Cotonti/blob/1.0.0/modules/users/inc/users.passrecover.php technical-description
- https://github.com/Cotonti/Cotonti product
- VulnCheck Advisory: Cotonti through 1.0.0 Predictable Password Recovery Token via Weak PRNG third-party-advisory