Threats tagged 'ghsa-gx42-rqfg-r6jm'

Cotonti versions through 1.0.0 use md5(microtime()) to generate registration and email-change validation tokens. This method allows attackers to predict tokens by deriving the generation time from the HTTP Date header and computing candidate tokens offline. Exploiting this vulnerability enables bypassing email-ownership verification, potentially activating accounts or confirming email addresses without control over them.