CVE-2026-94413 jshERP through 3.6 Password Hash Disclosure via /user/info
Authenticated users can retrieve unsalted MD5 password hashes for any user via the /user/info endpoint, enabling offline cracking or authentication bypass.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-94413?
CVE-2026-94413 is a high-severity vulnerability in jishenghua jshERP, published on 21 Sep 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
jshERP through 3.6 fails to redact password hashes in the /user/info endpoint, allowing authenticated users to retrieve unsalted MD5 password digests for any user. Attackers can request arbitrary user information by supplying user IDs to obtain password hashes usable for offline cracking or direct authentication bypass.
Weakness: CWE-200
Which versions are affected by CVE-2026-94413?
How do I fix CVE-2026-94413?
No fix has been published for CVE-2026-94413 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-94413 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-94413 exists.
Sources
Also known as GHSA-w4x2-8gxc-hh47.