CVE-2026-80211 FrontAccounting through 2.4.20 Use of Unsalted MD5 for Password Storage
FrontAccounting stores passwords using unsalted MD5, allowing attackers to recover plaintext credentials via rainbow tables or brute force if the database is compromised.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-80211?
CVE-2026-80211 is a high-severity vulnerability in FrontAccounting, published on 27 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
FrontAccounting through 2.4.20 stores and verifies user passwords as unsalted MD5 digests. admin/users.php passes md5($_POST['password']) to add_user() and update_user_password(), admin/change_current_user_password.php does the same when a user changes their own password, the forgotten-password path in includes/current_user.inc hashes the newly generated password the same way, and authentication calls get_user_auth($loginname, md5($password)). The codebase applies no per-password salt and contains no call to password_hash(), password_verify() or any other adaptive hash, so identical passwords yield identical digests and an attacker who obtains the user table can recover plaintext passwords with precomputed lookup tables or high-rate GPU cracking.
Weakness: CWE-916
Which versions are affected by CVE-2026-80211?
How do I fix CVE-2026-80211?
No fix has been published for CVE-2026-80211 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-80211 being exploited?
There is no known exploitation of CVE-2026-80211 in the wild and no public exploit code.
Sources
Also known as GHSA-hc7j-jf63-wgj6.