Cve-2026-121450 - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/tags/cve-2026-121450/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioTue, 03 Nov 2026 18:00:52 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgCFNext: Weak cryptographic derivation in subscription link (CVE-2026-121450)https://feed.craftedsignal.io/briefs/2026-11-cfnext-cryptographic-vuln/Tue, 03 Nov 2026 18:00:52 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-11-cfnext-cryptographic-vuln/CFNext versions before 3.1.0 utilize a weak MD5-based cryptographic derivation for subscription UUIDs, enabling offline brute-force attacks to recover administrative passwords and exfiltrate stored proxy and API credentials.CFNext versions prior to 3.1.0 contain a vulnerability where the subscription UUID is generated using an MD5 hash of the administrator password combined with a static, public salt. This implementation allows unauthorized individuals possessing a valid subscription link to perform offline brute-force attacks to recover the cleartext administrator password. Successful exploitation grants full administrative access to the CFNext panel, allowing the retrieval of sensitive configuration secrets, including Trojan, Clash, Telegram, and Cloudflare API credentials.

Impact

Successful exploitation results in full administrative compromise of the CFNext instance. Impact includes unauthorized access to system administration functions and the exposure of sensitive service credentials and proxy configuration secrets.

Recommendation

  • Upgrade CFNext to version 3.1.0 or later immediately to remediate the weak cryptographic derivation logic.
  • Audit logs for administrative account activity from unrecognized IP addresses, specifically looking for repeated login attempts indicative of brute-forcing or credential stuffing.
  • Rotate all API keys and credentials (Trojan, Clash, Telegram, Cloudflare) stored within the CFNext instance if evidence of unauthorized administrative access is detected.
]]>highadvisorycve-2026-121450cryptographyauthentication