CVE-2026-92921 — admin3 through 3.0.0 Weak Password Hashing via Single-Round MD5
admin3 through 3.0.0 stores account passwords using single-round MD5 with only the username as salt and no key derivation function. Attackers with database access can recover pl…
Published: 2026-09-17 · CVSS: 6.9 · CVSS 4.0
admin3 through 3.0.0 stores account passwords using single-round MD5 with only the username as salt and no key derivation function. Attackers with database access can recover plaintext passwords through offline dictionary or brute-force attacks due to negligible computational effort.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7