CVE Intelligence
Analysis AI-assisted

CVE-2026-26219: newbee-mall Unsalted MD5 Password Hashing Enables Offline Credential Cracking

newbee-mall hashes user passwords with unsalted MD5 and without computational cost controls, so anyone who obtains the stored hashes can attempt fast offline recovery of plaintext passwords. The CNA VulnCheck records a CVSS base score of 9.1 and maps the weakness to CWE-327. The record lists no fixed version, and no confirmed exploitation appears in the sources consulted.

Published Oct 24, 2026 · Updated Oct 24, 2026 · Ler em português

Overview

newbee-mall, an e-commerce project, stores and verifies user passwords with unsalted MD5. Without a per-user salt or a work factor, identical passwords produce identical hashes and recovery is fast once hashes are obtained. The CNA VulnCheck published its advisory on the weakness, see VulnCheck advisory, and the project issue is tracked at GitHub issue 119.

Impact

  • Confidentiality of user credentials is at risk if password hashes are exposed.
  • Recovered passwords may be reused on other services, extending the impact beyond newbee-mall.
  • The CNA records a CVSS base score of 9.1 with high confidentiality and integrity impact.

Affected products and versions

  • Newbee-ltd Newbee-mall: version 1.0.0.
  • Newbee-mall Project Newbee-mall: up to and including 1.0.0.
  • The record lists no fixed version.

Exploitation status

The CVE is not listed in the CISA KEV catalog in the record, so active exploitation is not confirmed. No confirmed exploitation appears in the sources consulted. The GitHub issue reference carries an exploit-related tag, but this analysis does not describe any exploitation method.

Remediation and mitigation

  • No fixed version is present in the record. Treat this as unknown, not as proof that no fix exists.
  • Check the vendor issue tracker for updates before choosing an upgrade path.
  • Plan migration of stored passwords to a salted, slow adaptive hashing function, and force password resets for accounts whose hashes may have been exposed.
  • Restrict access to database dumps and backups and encrypt them at rest.

Detection guidance

  • Monitor for unusual bulk reads of user tables or unexpected database exports.
  • Review access logs for backup storage and for authentication anomalies on user accounts.

Limitations of the available information

  • The record does not describe the code structure or the exact code paths affected.
  • No fixed version, patch or vendor statement is included in the record.
  • The EPSS probability is 0.0032, but a low score does not rule out offline cracking once hashes are exposed.

Frequently asked questions

What is the core weakness in CVE-2026-26219?

newbee-mall stores and verifies passwords with unsalted MD5 and no computational cost controls, which makes offline recovery of exposed password hashes fast. The weakness is mapped to CWE-327.

Is there a fixed version available?

The record does not list a fixed version. Availability of a fix is unknown, so check the vendor issue tracker and project updates.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.