A critical vulnerability in Cotonti versions through 1.0.0 allows unauthenticated attackers to hijack any user account, including administrator accounts, by predicting password recovery tokens.

The application utilizes the md5(microtime()) function to generate password recovery validation tokens within the users.passrecover.php file. Because this method is cryptographically weak, an unauthenticated attacker can predict the token space and successfully reset the password of any registered user.

This vulnerability poses a severe risk to organizational security, as it facilitates full account takeover. Successful exploitation allows unauthorized parties to gain administrative access, leading to potential data exfiltration, system configuration tampering, or complete site compromise. Given the CVSS score of 8.1, the high likelihood of exploitation against sensitive accounts necessitates immediate remediation.

Immediate Action: There is currently no official patch available; administrators should restrict access to the password recovery functionality or disable it until a secure version is released by the vendor.

Proactive Monitoring: Security teams should review server access logs for repeated, high-frequency requests to the password recovery endpoint, which may indicate an automated token-guessing attempt.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rate-limiting rules specifically configured to block excessive requests to the users.passrecover.php endpoint to mitigate the feasibility of a brute-force attack.

Public Exploit Available: Unknown

The severity of this flaw cannot be overstated, as it provides a direct path to administrative compromise without requiring credentials. Organizations currently running Cotonti 1.0.0 or earlier must prioritize the implementation of compensating controls, such as strict rate limiting, and monitor vendor channels diligently for the release of a security patch. Failure to address this vulnerability effectively leaves all user accounts exposed to trivial takeover.