CVE-2026-110104: novel through 3.5.0 Unsalted MD5 Password Storage
Xxyopen novel through 3.5.0 contains a weak password hashing vulnerability that allows attackers to recover plaintext passwords because UserServiceImpl.register() stores unsalted MD5 digests in userinfo.password. Attackers who obtain the password column through a database leak or backup exposure can crack hashes with precomputed tables or GPU brute force and reuse credentials.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to credential recovery risk?
Deployments of Xxyopen Novel through 3.5.0 are at risk if an attacker can obtain the user_info.password column, such as through a database leak or exposed backup. Users who reuse their Novel password on other services face additional account-takeover risk.
Can this be exploited remotely without access to stored password hashes?
No direct remote exploitation path is described. An attacker first needs access to the stored password hashes from the database or a backup; the MD5 hashes can then be cracked using precomputed tables or GPU brute force.
What should be done if the password database may have been exposed?
Treat affected passwords as potentially recoverable and require password resets for impacted users. Users should also change the same password anywhere it was reused.