CVE-2026-92921: admin3 through 3.0.0 Weak Password Hashing via Single-Round MD5
admin3 through 3.0.0 stores account passwords using single-round MD5 with only the username as salt and no key derivation function. Attackers with database access can recover plaintext passwords through offline dictionary or brute-force attacks due to negligible computational effort.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this weakness?
An attacker needs access to the database containing account credential hashes. The attack is performed offline, allowing dictionary or brute-force attempts without interacting with the application.
What is the practical impact if the credential database is exposed?
Password hashes can be cracked with negligible computational effort because they use single-round MD5, the username as the only salt, and no key derivation function. Recovered plaintext passwords may also put other accounts at risk where users reused those passwords.
How can I determine whether my deployment is affected?
Deployments of admin3 through version 3.0.0 are affected. Inspect stored credential hashes and the password-handling implementation for single-round MD5 hashing with the username used as the salt.
What can be done while a remediation is not available?
Restrict and monitor database access, protect database backups and exports, and rotate passwords for potentially exposed accounts. Because password cracking can occur offline after database access, reducing database exposure is the key immediate control.