CVE-2026-25861 QloApps 1.7.0 Weak Password Hashing via MD5 in Tools.php
Attackers can compromise user credentials via offline brute-force attacks on weak MD5 password hashes in QloApps.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-25861?
CVE-2026-25861 is a high-severity vulnerability in QloApps, published on 2 Jun 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
QloApps through 1.7.0, fixed in commit 64e9722, contains a weak cryptographic algorithm vulnerability that allows attackers to compromise user credentials by exploiting the use of MD5 for password hashing in the Tools::encrypt() function within classes/Tools.php, which concatenates a static cookie key with the supplied password. Attackers can perform offline brute-force attacks against the MD5 hashes, with the risk compounded by auto-generated 8-character passwords assigned during guest-to-customer account conversion in classes/Customer.php, making credential recovery trivial.
Weakness: CWE-916
Which versions are affected by CVE-2026-25861?
How do I fix CVE-2026-25861?
No fix has been published for CVE-2026-25861 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-25861 being exploited?
There is no known exploitation of CVE-2026-25861 in the wild and no public exploit code.
Sources
Also known as GHSA-xcxp-3whg-h83c.