{"id":"CVE-2026-121450","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-121450","summary":"CFNext before 3.1.0 Admin Password Recovery via MD5-Derived Subscription UUID","details":"CFNext before 3.1.0 contains a weak cryptographic derivation vulnerability that allows subscription link holders to recover the admin password because the subscription UUID is an MD5 of the password with a fixed public salt. Attackers can brute-force the password offline without rate limiting, log into the admin panel, and read stored Trojan, Clash, Telegram and Cloudflare API secrets.","published":"2026-11-03T15:17:00.510Z","modified":"2026-11-04T02:47:35.770417566Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":{"url":"https://github.com/PAICNI/CFNext/commit/ca8ad82bb7c635f765c82a1cd0c954fd70d81fb7","label":"PAICNI/CFNext@ca8ad82"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/121xxx/CVE-2026-121450.json"},{"type":"PACKAGE","url":"https://github.com/PAICNI/CFNext"},{"type":"ARTICLE","url":"https://github.com/PAICNI/CFNext/blob/1c7b3d8bed5b06a1449ea28302bb9a648f67e8e1/CFNext-%E6%98%8E%E6%96%87%E7%89%88.js#L12"},{"type":"ARTICLE","url":"https://github.com/PAICNI/CFNext/blob/1c7b3d8bed5b06a1449ea28302bb9a648f67e8e1/CFNext-%E6%98%8E%E6%96%87%E7%89%88.js#L2440"},{"type":"FIX","url":"https://github.com/PAICNI/CFNext/commit/ca8ad82bb7c635f765c82a1cd0c954fd70d81fb7"},{"type":"REPORT","url":"https://github.com/PAICNI/CFNext/issues/57"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-121450"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/cfnext-before-3.1.0-admin-password-recovery-via-md5-derived-subscription-uuid"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-11-04T02:47:35.770417566Z"}}