FrontAccounting Use of Password Hash With Insufficient Computational Effort Vulnerability - CVE-2026-80211 - Vulnerability Database

FrontAccounting Use of Password Hash With Insufficient Computational Effort Vulnerability - CVE-2026-80211

Medium

Reference: CVE-2026-80211

NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2026-80211

Title: FrontAccounting Use of Password Hash With Insufficient Computational Effort Vulnerability

Overview:

FrontAccounting through 2.4.20 stores and verifies user passwords as unsalted MD5 digests. admin/users.php passes md5(_POSTpassword) to add_user() and update_user_password() admin/change_current_user_password.php does the same when a user changes their own password the forgotten-password path in includes/current_user.inc hashes the newly generated password the same way and authentication calls get_user_auth(loginname md5(password)). The codebase applies no per-password salt and contai