CVE-2026-26219
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk9th percentile - higher than 9% of all known CVEs
Summary
The vulnerability in newbee-mall stores user passwords using an unsalted MD5 hashing algorithm. The lack of per-user salts and computational cost controls allows attackers who obtain password hashes via database exposure or backup leakage to quickly recover plaintext credentials through offline attacks.
Risk Assessment
The organization faces user identity theft and unauthorized system access, as attackers can easily crack passwords and take over accounts.
Recommendation
Immediately update the password storage mechanism to a secure salted algorithm such as bcrypt, scrypt, or Argon2, and force all users to change their passwords.
Original NVD description (English source)
newbee-mall stores and verifies user passwords using an unsalted MD5 hashing algorithm. The implementation does not incorporate per-user salts or computational cost controls, enabling attackers who obtain password hashes through database exposure, backup leakage, or other compromise vectors to rapidly recover plaintext credentials via offline attacks.