CVE-2026-110104

Deferred Deferred - Pending Action

Weak Password Hashing in Xxyopen Novel

Publication date: 2026-10-13

Last updated on: 2026-10-16

Assigner: VulnCheck

Description

Xxyopen novel through 3.5.0 contains a weak password hashing vulnerability that allows attackers to recover plaintext passwords because UserServiceImpl.register() stores unsalted MD5 digests in user_info.password. Attackers who obtain the password column through a database leak or backup exposure can crack hashes with precomputed tables or GPU brute force and reuse credentials.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-13

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110104

EUVD

EUVD-2026-98937

Affected Vendors & Products

Vendor	Product	Version / Range
xxyopen	novel	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-916	The product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive.

Attack-Flow Graph

Executive Summary

This vulnerability involves the xxyopen novel software storing user passwords as unsalted MD5 hashes in the user_info.password field. MD5 is a weak hashing algorithm that lacks salt, making it vulnerable to offline cracking attacks using precomputed tables or GPU brute force. Attackers who gain access to the database can recover plaintext passwords and potentially reuse them across other services.

Detection Guidance

To detect this vulnerability, check if your system stores passwords as unsalted MD5 hashes in the user_info.password field. Inspect the UserServiceImpl.register() method for MD5 usage without salting. Query the database for passwords matching a 32-character hexadecimal pattern typical of MD5 hashes.

Impact Analysis

If you used this software before version 3.5.1, your password may have been stored insecurely. Attackers could crack your password hash if they obtained the database. If you reused this password elsewhere, attackers might gain access to other accounts. The vulnerability allows efficient offline cracking due to unsalted MD5 hashes.

Compliance Impact

This vulnerability likely violates data protection requirements under GDPR and HIPAA, which mandate secure storage of personal data including passwords. Unsalted MD5 hashing fails to meet modern security standards for password storage, exposing organizations to compliance violations and potential fines.

Mitigation Strategies

Immediately upgrade to a patched version of the software that uses BCrypt for password hashing. If upgrading is not possible, implement BCrypt hashing manually in the UserServiceImpl.register() method. Rotate all user passwords after applying the fix to ensure security.

Hi! I’m here to help you understand CVE-2026-110104. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70