CVE-2026-112029

Received Received - Intake

Insufficient Password Hashing in Diem Project

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: VulDB

Description

A vulnerability has been found in diem-project diem up to 5.1.3. This affects an unknown part of the file lib/model/doctrine/PluginDmUser.class.php of the component SHA1 Handler. Such manipulation of the argument salt/password leads to password hash with insufficient computational effort. The attack needs to be performed locally. The attack requires a high level of complexity. It is indicated that the exploitability is difficult. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-18

Generated

2026-10-19

AI Q&A

2026-10-19

EPSS Evaluated

N/A

NVD

CVE-2026-112029

EUVD

EUVD-2026-104013

Affected Vendors & Products

Vendor	Product	Version / Range
diem-project	diem	5.1.0
diem-project	diem	5.1.1
diem-project	diem	5.1.2
diem-project	diem	5.1.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-326	The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.
CWE-916	The product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive.

Attack-Flow Graph

Executive Summary

This vulnerability exists in the diem-project diem software up to version 5.1.3. It involves a weakness in the SHA1 Handler component, specifically in the file lib/model/doctrine/PluginDmUser.class.php. The issue allows manipulation of the salt or password arguments, resulting in a password hash that requires insufficient computational effort to crack.

Detection Guidance

This vulnerability involves weak password hashing due to insufficient computational effort in the SHA1 handler of the diem-project diem up to version 5.1.3. Detection requires checking for outdated or vulnerable versions of the diem-project diem software and inspecting password hashing mechanisms for weak SHA1 usage.

Impact Analysis

An attacker could exploit this vulnerability to perform a local attack requiring high complexity. If successful, they might recover weak password hashes, potentially gaining unauthorized access to user accounts. The exploit is publicly available and may be used.

Compliance Impact

This vulnerability involves weak password hashing due to insufficient computational effort, which could lead to unauthorized access if exploited. For compliance with GDPR or HIPAA, such a flaw may violate requirements for protecting personal or health data, as weak hashing undermines data security principles.

Mitigation Strategies

Update the diem-project diem software to the latest version beyond 5.1.3 to address the password hash weakness. Review and strengthen local authentication mechanisms, especially those using SHA1 hashing with insufficient computational effort.

Hi! I’m here to help you understand CVE-2026-112029. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70