CVE-2026-80211

Received Received - Intake

FrontAccounting Unsafe MD5 Password Storage Vulnerability

Publication date: 2026-08-27

Last updated on: 2026-08-29

Assigner: VulnCheck

Description

FrontAccounting through 2.4.20 stores and verifies user passwords as unsalted MD5 digests. admin/users.php passes md5($_POST['password']) to add_user() and update_user_password(), admin/change_current_user_password.php does the same when a user changes their own password, the forgotten-password path in includes/current_user.inc hashes the newly generated password the same way, and authentication calls get_user_auth($loginname, md5($password)). The codebase applies no per-password salt and contains no call to password_hash(), password_verify() or any other adaptive hash, so identical passwords yield identical digests and an attacker who obtains the user table can recover plaintext passwords with precomputed lookup tables or high-rate GPU cracking.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-27

Last Modified

2026-08-29

Generated

2026-09-16

AI Q&A

2026-08-27

EPSS Evaluated

2026-09-15

NVD

CVE-2026-80211

EUVD

EUVD-2026-67145

Affected Vendors & Products

Vendor	Product	Version / Range
frontaccounting	frontaccounting	to 2.4.20 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-916	The product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive.

Attack-Flow Graph

Executive Summary

This vulnerability involves FrontAccounting storing user passwords as unsalted MD5 hashes. The application uses MD5($_POST['password']) directly in functions like add_user() and get_user_auth(), without salts or adaptive hashing methods. Identical passwords produce identical hashes, allowing attackers with access to the user table to crack passwords using precomputed tables or GPU cracking.

Detection Guidance

Check FrontAccounting database tables for user passwords stored as MD5 hashes without salts. Inspect PHP files like admin/users.php, admin/change_current_user_password.php, and includes/current_user.inc for MD5 password handling. Search for md5() function calls in authentication-related code.

Impact Analysis

An attacker who gains access to the user table can recover plaintext passwords through brute-force attacks. This could lead to unauthorized account access, data breaches, or further exploitation of the system. The lack of password hashing best practices increases the risk of credential theft and misuse.

Compliance Impact

This vulnerability likely violates compliance requirements for secure password storage under GDPR and HIPAA. Both regulations mandate strong, salted password hashing to protect user data. Unsalted MD5 hashes do not meet these standards, potentially resulting in regulatory penalties and loss of trust.

Mitigation Strategies

Replace MD5 password storage with PHP's password_hash() using bcrypt. Update authentication functions to use password_verify() instead of direct MD5 comparisons. Force password resets for all users and enforce stronger password policies.

Hi! I’m here to help you understand CVE-2026-80211. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70