PAICNI CFNext subscription UUID lets attackers recover admin password

Summary

Before 3.1.0, the CFNext subscription UUID is an MD5 of the admin password with a fixed public salt, so anyone holding a subscription link can brute-force the password offline. Once logged in, they can read stored Trojan, Clash, Telegram and Cloudflare API secrets.

Affected when

• before 3.1.0
• holder of a subscription link

What to do

Update to 3.1.0 or later. No stopgap is given.

Products and platforms

• PAICNI CFNext

CVE IDs

• CVE-2026-121450 (opens in a new tab)

Sources

• Write-up: github.com (opens in a new tab) · github.com (opens in a new tab) · vulncheck.com (opens in a new tab) · github.com (opens in a new tab)
• CVE record: cve.org (opens in a new tab)

Times

First published 2026-11-03 15:17 UTC

First seen 2026-11-09 14:50 UTC