Predictable Password Recovery Tokens in Cotonti Products
CVE-2026-93868

9.2CRITICAL

Key Information:

Vendor

Cotonti

Status
Cotonti
Vendor
CVE Published:
18 September 2026

What is CVE-2026-93868?

Cotonti prior to version 1.0.0 features a flaw in its password recovery process. The system generates validation tokens using predictable methods based on the server's Date header. Attackers can exploit this by reading the Date header, allowing them to precompute a range of potential tokens. This predictable token space effectively enables unauthorized users to reset passwords for any account, including those of administrators, by probing the authentication endpoint with these precomputed values.

Affected Version(s)

Cotonti 0 <= 1.0.0

References

https://github.com/Cotonti/Cotonti/issues/1890
issue-tracking
https://github.com/Cotonti/Cotonti/pull/1898
patchissue-tracking
https://github.com/Cotonti/Cotonti/blob/1.0.0/modules/use...
technical-description

CVSS V4

Score:
9.2
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Harsh Raj Singhania
.