CVE-2026-94107CWE-338

CVE-2026-94107

High · published September 20, 2026

CVSS v3.1
8.1
EPSS
1%
Percentile
46.3
In the wild
Unconfirmed
What it is

NivoCart through 2.4.0 contains a predictable password reset token vulnerability in the forgotten.php endpoint that generates recovery codes using substr(md5(mt_rand()), 0, 10). Attackers who know an administrator's email address can request a password reset and predict the token to gain administrative account access without rate limiting or expiration.

The record
Technical detail
CVSS v3.1
8.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
9.2 · CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
EPSS
0.00568 · 46.3th percentile
Weakness
CWE-338 · Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
Published
2026-09-20T16:17Z
References (5)
https://github.com/nivocart/nivocart · [email protected]https://github.com/nivocart/nivocart/blob/6ea6600cda1263ae70c0aab0a70d31091a32c46b/upload/admin/controller/common/forgotten.php#L20-L34 · [email protected]https://github.com/nivocart/nivocart/blob/6ea6600cda1263ae70c0aab0a70d31091a32c46b/upload/admin/model/user/user.php#L119-L123 · [email protected]https://github.com/nivocart/nivocart/issues/25 · [email protected]https://www.vulncheck.com/advisories/nivocart-through-2.4.0-predictable-administrator-password-reset-token · [email protected]
EPSS history
Timeline
  • 22 SEP 03:44Z
    EPSS moved — → 0%
    epss
  • 20 SEP 11:09Z
    NivoCart through 2.4.0 Predictable Administrator Password Reset Token
    cvelistv5