CVE-2026-25861: QloApps 1.7.0 Weak Password Hashing via MD5 in Tools.php
QloApps through 1.7.0, fixed in commit 64e9722, contains a weak cryptographic algorithm vulnerability that allows attackers to compromise user credentials by exploiting the use of MD5 for password hashing in the Tools::encrypt() function within classes/Tools.php, which concatenates a static cookie key with the supplied password. Attackers can perform offline brute-force attacks against the MD5 hashes, with the risk compounded by auto-generated 8-character passwords assigned during guest-to-customer account conversion in classes/Customer.php, making credential recovery trivial.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
QloAppsto a version that resolves this vulnerability.Fixed in 1.7.0Patch 64e9722 - Configuration
Update/modify classes/Tools.php so Tools::encrypt() no longer uses MD5 for password hashing (it currently concatenates a static cookie key with the supplied password).
QloApps (classes/Tools.php Tools::encrypt()) Password hashing algorithm = MD5 (avoid)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-25861?
CVE-2026-25861 has a medium severity rating of 5.9.
How do I fix CVE-2026-25861?
To fix CVE-2026-25861, update QloApps to version 1.7.1 or later where the vulnerability has been patched.
What causes CVE-2026-25861?
CVE-2026-25861 is caused by the use of the MD5 hashing algorithm for password storage in QloApps.
What are the risks associated with CVE-2026-25861?
The risks associated with CVE-2026-25861 include the potential for attackers to compromise user credentials.
Which version of QloApps is affected by CVE-2026-25861?
QloApps versions up to 1.7.0 are affected by CVE-2026-25861.