{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/cfnext--3.1.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:cfnext:cfnext:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-121450"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["CFNext (\u003c 3.1.0)"],"_cs_severities":["high"],"_cs_tags":["cve-2026-121450","cryptography","authentication"],"_cs_type":"advisory","_cs_vendors":["CFNext"],"content_html":"\u003cp\u003eCFNext versions prior to 3.1.0 contain a vulnerability where the subscription UUID is generated using an MD5 hash of the administrator password combined with a static, public salt. This implementation allows unauthorized individuals possessing a valid subscription link to perform offline brute-force attacks to recover the cleartext administrator password. Successful exploitation grants full administrative access to the CFNext panel, allowing the retrieval of sensitive configuration secrets, including Trojan, Clash, Telegram, and Cloudflare API credentials.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation results in full administrative compromise of the CFNext instance. Impact includes unauthorized access to system administration functions and the exposure of sensitive service credentials and proxy configuration secrets.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade CFNext to version 3.1.0 or later immediately to remediate the weak cryptographic derivation logic.\u003c/li\u003e\n\u003cli\u003eAudit logs for administrative account activity from unrecognized IP addresses, specifically looking for repeated login attempts indicative of brute-forcing or credential stuffing.\u003c/li\u003e\n\u003cli\u003eRotate all API keys and credentials (Trojan, Clash, Telegram, Cloudflare) stored within the CFNext instance if evidence of unauthorized administrative access is detected.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-03T18:00:52Z","date_published":"2026-11-03T18:00:52Z","id":"https://feed.craftedsignal.io/briefs/2026-11-cfnext-cryptographic-vuln/","summary":"CFNext versions before 3.1.0 utilize a weak MD5-based cryptographic derivation for subscription UUIDs, enabling offline brute-force attacks to recover administrative passwords and exfiltrate stored proxy and API credentials.","title":"CFNext: Weak cryptographic derivation in subscription link (CVE-2026-121450)","url":"https://feed.craftedsignal.io/briefs/2026-11-cfnext-cryptographic-vuln/"}],"language":"en","title":"CraftedSignal Threat Feed - CFNext (\u003c 3.1.0)","version":"https://jsonfeed.org/version/1.1"}