CVE-2026-88837: Busybox: busybox: httpd misidentifies yescrypt password hashes as plaintext, inverting authentication
A vulnerability exists in the BusyBox httpd applet's Basic Authentication password verification logic in networking/httpd.c. The code uses if (passwd[0] == '$' && isdigit(passwd[1])) to distinguish hashed passwords from plaintext. Yescrypt hashes begin with $y$, and because 'y' does not satisfy isdigit(), the detection logic fails. The code falls through to the plaintext strcmp branch, making the stored hash string itself the "password."
Supplying the literal hash string as the password results in HTTP 200, while the actual plaintext password is rejected with HTTP 401. Exploitation requires the attacker to first obtain the hash string from httpd.conf.
Other sources
BusyBox httpd treats yescrypt ($y$) password hashes as plaintext during Basic Authentication, inverting the authentication check.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What must an attacker obtain before exploiting this issue?
The attacker must first obtain the literal yescrypt hash string stored in httpd.conf. They can then submit that hash string itself as the Basic Authentication password.
Which password entries are affected?
The described flaw affects BusyBox httpd Basic Authentication entries using yescrypt hashes, which begin with $y$. BusyBox httpd misclassifies those values as plaintext rather than verifying them as password hashes.
How can I determine whether a service is vulnerable?
Inspect the password value used by BusyBox httpd in httpd.conf. If it begins with $y$, test behavior carefully: the configured plaintext password is rejected, while supplying the complete stored hash string as the password returns HTTP 200.
Is a service protected if an attacker cannot read httpd.conf?
The described exploitation requires obtaining the hash string from httpd.conf first. Without that value, the provided information does not describe a way to authenticate using this flaw.