CVE-2026-94107: NivoCart Auth Bypass Vulnerability

CVE-2026-94107 Overview

CVE-2026-94107 is a predictable password reset token vulnerability affecting NivoCart through version 2.4.0. The forgotten.php endpoint generates administrator recovery codes using substr(md5(mt_rand()), 0, 10), a construction that relies on a non-cryptographic pseudo-random number generator. An attacker who knows an administrator's email address can trigger a password reset and predict the resulting token. The endpoint enforces no rate limiting and no token expiration, extending the window for successful exploitation. Successful abuse yields full administrative access to the affected NivoCart store. The vulnerability is classified under CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator.

Critical Impact

Attackers with knowledge of an admin email can predict the password reset token and take over the administrator account without authentication.

Affected Products

• NivoCart versions through 2.4.0
• upload/admin/controller/common/forgotten.php
• upload/admin/model/user/user.php

Discovery Timeline

• 2026-09-20 - CVE-2026-94107 published to NVD
• 2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-94107

Vulnerability Analysis

The vulnerability resides in the administrator password recovery workflow of NivoCart. When a reset is requested, the application generates a recovery code by hashing the output of PHP's mt_rand() with MD5, then truncating the hash to 10 hexadecimal characters. mt_rand() implements the Mersenne Twister algorithm, which is not cryptographically secure and can be predicted after observing a small number of outputs. Truncating an MD5 digest to 10 characters further reduces the effective keyspace. The generated code is stored server-side and emailed to the administrator as the sole authentication factor for the password reset. Because the reset flow does not enforce rate limiting, attackers can submit repeated requests. The application also does not expire tokens, so predicted codes remain valid indefinitely. Public source references identify the vulnerable logic in forgotten.php lines 20-34 and user.php lines 119-123.

Root Cause

The root cause is the use of mt_rand() as a source of entropy for a security-sensitive token. PHP documentation explicitly warns that mt_rand() is not suitable for cryptographic purposes. Secure equivalents such as random_bytes() or random_int() should be used to generate recovery tokens.

Attack Vector

An attacker who knows or guesses an administrator's email address submits a password reset request to /admin/index.php?route=common/forgotten. The attacker then predicts the mt_rand() output, computes the corresponding truncated MD5 value, and submits the predicted code to complete the reset. The lack of rate limiting supports brute force attempts, and the absence of token expiration allows delayed exploitation. See the VulnCheck advisory for additional technical detail.

// Vulnerable pattern described in advisory (prose reference only)
// $code = substr(md5(mt_rand()), 0, 10);
// See linked source references above for the original implementation

Detection Methods for CVE-2026-94107

Indicators of Compromise

• Repeated POST requests to the common/forgotten route from the same source address
• Successful password reset events for administrator accounts without a preceding legitimate user request
• New or altered administrator accounts created shortly after reset activity
• Web server access logs showing enumeration of /admin/index.php?route=common/reset with varying code parameters

Detection Strategies

• Monitor authentication logs for administrator password changes that are not tied to a corresponding help-desk ticket or user action
• Alert on high-frequency access to forgotten.php and reset.php endpoints from a single client
• Baseline expected password reset volume and flag deviations for review
• Correlate reset activity with subsequent administrative configuration changes

Monitoring Recommendations

• Ingest NivoCart web and application logs into a centralized logging platform for correlation
• Retain administrator activity logs for a minimum of 90 days to support post-incident investigation
• Establish alerts for the creation of new admin users or privilege changes following any reset event

How to Mitigate CVE-2026-94107

Immediate Actions Required

• Restrict access to the NivoCart administrative interface to trusted IP ranges using network or web server access controls
• Rotate all administrator passwords and audit existing administrator accounts for unauthorized additions
• Disable or gate the common/forgotten route until a patched build is deployed
• Review web server logs for prior exploitation attempts against forgotten.php

Patch Information

No official vendor patch is referenced in the NVD entry at the time of publication. Track the NivoCart GitHub repository and issue #25 for remediation status. Any fix should replace mt_rand() with random_bytes() or random_int(), expand the token length, add token expiration, and enforce rate limiting on the reset endpoint.

Workarounds

• Place NivoCart's admin path behind an authenticating reverse proxy or VPN
• Add a web application firewall rule to rate-limit requests to forgotten.php and reset.php
• Require multi-factor authentication for administrator sign-in where the deployment supports it
• Temporarily disable the password reset feature and manage credential resets manually through the database

# Example nginx rate-limit for the reset workflow
# limit_req_zone $binary_remote_addr zone=nivocart_reset:10m rate=5r/m;
# location ~* /admin/index.php {
#     if ($arg_route ~* "common/(forgotten|reset)") {
#         limit_req zone=nivocart_reset burst=5 nodelay;
#     }
# }