CVE-2026-107829: Jivejdon through 5.0 Unsalted MD5 Password Storage via AccountDaoSql
Jivejdon through 5.0 contains a weak password storage vulnerability that stores account passwords as unsalted MD5 digests via ToolsUtil.hash() in AccountDaoSql. Attackers who obtain the user table through database access or SQL injection can crack passwords with precomputed tables or GPU attacks.
Affected Software
Event History
Frequently Asked Questions
What must an attacker obtain to exploit the weak password storage?
The attacker needs access to the user table, such as through database access or a SQL injection flaw. They can then attempt to crack the unsalted MD5 password digests using precomputed tables or GPU-based attacks.
What is the likely impact if the password digest table is exposed?
Stored password digests may be cracked, exposing account passwords. Because the hashes are unsalted MD5, identical passwords produce identical digests and are more susceptible to precomputed-table attacks.
Which component handles the vulnerable password hashing?
The affected hashing occurs through ToolsUtil.hash() in AccountDaoSql. The issue is reported in Jivejdon through version 5.0.