Weak Cryptographic Derivation in CFNext Allows Admin Password Recovery

CVE-2026-121450

What is CVE-2026-121450?

Prior to version 3.1.0, CFNext features a cryptographic flaw allowing subscription link holders to exploit password recovery. The vulnerability stems from using MD5 to derive subscription UUIDs with a fixed public salt. This design flaw enables attackers to brute-force the admin password offline due to the lack of rate limiting. Should an attacker gain access, they could log into the admin panel, gaining sensitive information such as Trojan, Clash, Telegram, and Cloudflare API secrets. Immediate updates and patching are recommended to mitigate the risk.

References