CVE-2026-80211: FrontAccounting through 2.4.20 Use of Unsalted MD5 for Password Storage
FrontAccounting through 2.4.20 stores and verifies user passwords as unsalted MD5 digests. admin/users.php passes md5($POST['password']) to adduser() and updateuserpassword(), admin/changecurrentuserpassword.php does the same when a user changes their own password, the forgotten-password path in includes/currentuser.inc hashes the newly generated password the same way, and authentication calls getuserauth($loginname, md5($password)). The codebase applies no per-password salt and contains no call to passwordhash(), passwordverify() or any other adaptive hash, so identical passwords yield identical digests and an attacker who obtains the user table can recover plaintext passwords with precomputed lookup tables or high-rate GPU cracking.
Affected Software
Event History
Frequently Asked Questions
What must an attacker obtain to take advantage of the weak password storage?
The attacker must obtain the user table or otherwise gain access to stored password digests. Because the digests are unsalted MD5, they can be attacked with precomputed lookup tables or high-rate GPU cracking.
Are password changes and password resets protected by a stronger hashing method?
No. Administrator-created or updated passwords, user-initiated password changes, and passwords generated by the forgotten-password flow are all hashed with MD5 without a per-password salt.
How can I determine whether an installation is affected?
Installations through version 2.4.20 are affected. The affected code hashes passwords with md5() for authentication and password-setting flows and does not use password_hash(), password_verify(), or another adaptive password-hashing mechanism.