CFNext: Weak cryptographic derivation in subscription link (CVE-2026-121450)

CFNext versions prior to 3.1.0 contain a vulnerability where the subscription UUID is generated using an MD5 hash of the administrator password combined with a static, public salt. This implementation allows unauthorized individuals possessing a valid subscription link to perform offline brute-force attacks to recover the cleartext administrator password. Successful exploitation grants full administrative access to the CFNext panel, allowing the retrieval of sensitive configuration secrets, including Trojan, Clash, Telegram, and Cloudflare API credentials.

Impact

Successful exploitation results in full administrative compromise of the CFNext instance. Impact includes unauthorized access to system administration functions and the exposure of sensitive service credentials and proxy configuration secrets.

Recommendation

• Upgrade CFNext to version 3.1.0 or later immediately to remediate the weak cryptographic derivation logic.
• Audit logs for administrative account activity from unrecognized IP addresses, specifically looking for repeated login attempts indicative of brute-forcing or credential stuffing.
• Rotate all API keys and credentials (Trojan, Clash, Telegram, Cloudflare) stored within the CFNext instance if evidence of unauthorized administrative access is detected.