CVE-2026-108109: Php Security Weak Prng Generated Credentialcve-2026-108109-php-security-weak-prng-generated-credential
A one-time verification code or replacement password is generated with a non-cryptographic PRNG (mt_rand/rand/lcg_value/uniqid). Its output is predictable or drawn from a tiny value space (e.g. a 6-digit OTP or a 5-digit numeric password), so an attacker who can reach the verification endpoint can guess the credential and take over the account, especially wh
