CVE-2026-26219 | THREATINT

Description

newbee-mall stores and verifies user passwords using an unsalted MD5 hashing algorithm. The implementation does not incorporate per-user salts or computational cost controls, enabling attackers who obtain password hashes through database exposure, backup leakage, or other compromise vectors to rapidly recover plaintext credentials via offline attacks.

PUBLISHED Reserved 2026-02-11 | Published 2026-02-12 | Updated 2026-02-12 | Assigner VulnCheck

CRITICAL: 9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

CRITICAL: 9.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Problem types

CWE-327 Use of a Broken or Risky Cryptographic Algorithm

Product status

Default status

unknown

1.0.0

affected

Credits

Lennon Chia finder

References

github.com/newbee-ltd/newbee-mall/issues/119 issue-tracking

www.vulncheck.com/...ing-enables-offline-credential-cracking third-party-advisory

cve.org (CVE-2026-26219)

nvd.nist.gov (CVE-2026-26219)

Download JSON