CVE-2026-94107 NivoCart through 2.4.0 Predictable Administrator Password Reset Token
Attackers can predict password reset tokens to take over administrator accounts in NivoCart due to weak random number generation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-94107?
CVE-2026-94107 is a critical vulnerability in nivocart, published on 20 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
NivoCart through 2.4.0 contains a predictable password reset token vulnerability in the forgotten.php endpoint that generates recovery codes using substr(md5(mt_rand()), 0, 10). Attackers who know an administrator's email address can request a password reset and predict the token to gain administrative account access without rate limiting or expiration.
Weakness: CWE-338
Which versions are affected by CVE-2026-94107?
How do I fix CVE-2026-94107?
No fix has been published for CVE-2026-94107 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-94107 being exploited?
There is no known exploitation of CVE-2026-94107 in the wild and no public exploit code.
Sources
Also known as GHSA-g4x6-pg76-867r.