Customer email-confirmation keys are generated using `md5(uniqid())`, while customer and administrator password-reset tokens use the non-cryptographic `uniqHash()` function. Unauthenticated attackers can brute-force the approximately 20-bit confirmation key through the `confirmAction` endpoint, which lacks rate limiting, to gain access as pending customers. Additionally, administrator reset tokens can be predicted after the generator state is recovered.