Threats affecting pkg:composer/cotonti

Cotonti versions up to 1.0.0 use a cryptographically weak pseudo-random number generator (PRNG) to create registration and email-change validation tokens. The tokens are generated using md5(microtime()), which can be predicted by attackers who derive the generation time from the HTTP Date header. This allows attackers to bypass email-ownership verification by computing candidate tokens offline and submitting them to the validation handler, enabling unauthorized account activation or email confirmation.