6.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-45701

CVE-2026-45701: Sulu: Weak Cryptographical usage for API Key generation and Reset Tokens

Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.23 and 3.0.6, the password reset tokenand API key generation uses a weak cryptographical hash algorithm. This issue has been patched in versions 2.6.23 and 3.0.6.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-45701

CVE-2026-45701:

6.9

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation NoneAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
sulu/sulu	composer	>= 3.0.0-alpha1, <= 3.0.5	3.0.6
sulu/sulu	composer	<= 2.6.22	2.6.23

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability stems from the use of weak cryptographic methods for generating security-sensitive values like password reset tokens and API keys. The analysis of the patch clearly shows the replacement of these weak methods with stronger, more secure alternatives.

Password Reset Token Generation: The ResettingController::generateTokenHash function was using the sha1 algorithm. SHA-1 is known to be vulnerable to collision attacks, which could allow an attacker to create a different input that produces the same hash, potentially compromising the password reset mechanism. The patch replaces sha1 with sha256, a much stronger and currently secure hashing algorithm.
API Key Generation: The User entity's constructor was generating an API key using md5(uniqid()). This is insecure for two reasons: uniqid() produces a predictable, non-random value based on the system's time, and md5 is a broken hash function with known vulnerabilities. This combination makes the generated API keys susceptible to being guessed or reverse-engineered. The patch addresses this by using random_bytes, which generates cryptographically secure random data, to create a truly unpredictable API key.

An attacker exploiting these vulnerabilities could potentially gain unauthorized access to user accounts by either hijacking a password reset process or guessing a user's API key.

Vulnerable functions

Sulu\Bundle\SecurityBundle\Controller\ResettingController::generateTokenHash

src/Sulu/Bundle/SecurityBundle/Controller/ResettingController.php

The function uses the weak 'sha1' hashing algorithm to generate a password reset token. This is vulnerable to collision attacks, making it easier for an attacker to generate a valid token.

Sulu\Bundle\SecurityBundle\Entity\User::__construct

src/Sulu/Bundle/SecurityBundle/Entity/User.php

The constructor uses `md5(uniqid())` to generate an API key. `uniqid()` is not a source of cryptographic randomness, and `md5` is a compromised hash function. This results in predictable API keys that an attacker could potentially guess.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.