EUVD-2026-113775
GHSA-wjj3-64hr-pjh8
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessGain access to Płatnik host or stored data
-
ExploitRetrieve encoded password from config/database
-
ExecutionReverse weak encoding to plaintext
-
ImpactReuse recovered credentials
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A04:2025 - Cryptographic Failures
ASVS 5.0
V11 - Cryptography Strong password encoding
|
| Exploitation Conditions | The attacker must first obtain the encoded password - from a local Płatnik configuration file or database, or by intercepting it - after which the weak, reversible encoding (CWE-261) allows trivial decoding back to plaintext. This prerequisite access is the key limiting factor: the flaw does not grant initial access by itself and is not remotely triggerable against a default install without first reaching the stored or transmitted credential. Affected: Płatnik versions up to and including 10.02.002; the only complete fix stated in the evidence is updating to version 10.02.002 (metric 242). No mitigation other than the update is stated in the available sources. |
| Impact | Supplied CVSS 4.0 base score is 7.7 (High) with vector AV:A/AC:H/AT:N/PR:N/UI:N and VC:H/VI:H/VA:H. No EPSS score, no CISA KEV listing, and no PoC or exploit reference are present in the input; vuln.today assigns the Decision label 'this_week' (not act_now/emergency). The exploitation status is therefore 'no public exploit identified at time of analysis'. The practical risk is secondary rather than primary: CWE-261 (weak/reversible password encoding) only matters AFTER an attacker has already obtained the encoded password, so this is a post-access credential-recovery weakness, not a remote mass-exploitation bug. CONFLICTING SIGNAL: the supplied vector states AV:A (adjacent network) and PR:N (no privileges), but the description - 'a user who obtains encoded password' - implies the attacker must first have access to the stored or transmitted credential (local config/database read, or interception), which is closer to AV:L and some prior access; verify the intended attack path with CERT-PL. Net: a real but not emergency issue, best treated as a 'patch this week' hygiene fix that reduces the blast radius of any other compromise, consistent with the this_week decision label. |
| Exploit ScenarioDerived | An insider or local attacker with access to a Płatnik installation reads the stored encoded password from its configuration or database (or captures it on the adjacent network during ZUS transmission), then applies the known weak, reversible encoding to recover the plaintext credential and reuse it. No public PoC or working exploit code is identified in the supplied data; only a CERT-PL advisory reference is present. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 30, 2026
Encoded passwords held by Płatnik, the Polish Social Insurance Institution (ZUS) client for submitting declarations and insurance documents, can be reversed back to plaintext because the software protects them with a weak, reversible encoding scheme rather than a proper one-way password hash (CWE-261). Płatnik installations up to and including version 10.02.002 are affected per the EUVD version range, and the attacker must first obtain the encoded credential - for example from a local configuration file or database, or by intercepting it in transit - before decoding it, so this flaw does not by itself provide initial access. The independent assessment maps the impact to confidentiality loss only (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N), which is materially narrower than the supplied CVSS 4.0 base score of 7.7 (AV:A/AC:H/AT:N/PR:N/UI:N with high confidentiality, integrity and availability impact). No public exploit code has been identified at time of analysis, and ZUS fixed the issue in version 10.02.002 (metric 242).
RemediationAI
Vendor-released patch: update Płatnik to version 10.02.002 and confirm that metric 242 has been applied, since the vendor states the issue was fixed in metric 242 in version 10.02.002; the reference advisory is https://cert.pl/posts/2026/10/CVE-2026-110970 with product information at https://www.zus.pl/firmy/program-platnik/o-programie-platnik. The available sources state no mitigation other than the update, and no compensating control (such as restricting file-system access to the local Płatnik configuration, or re-protecting stored credentials) is documented in the supplied materials; any such measure would be an interim safeguard only and would not remove the reversible encoding, so the update remains the only complete fix stated. Tracked priority is 'this_week' with no CISA KEV listing and no public exploit code identified, so the update can be scheduled within the normal patch cycle while noting that any encoded credential already exposed is decodable regardless of patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-261, Use of Weak Credentials / weak password encoding: Płatnik does not hash stored secrets one-way but encodes them with a trivially reversible transformation, so possession of the encoded string is effectively equivalent to possession of the plaintext password. The relevant technology is the ZUS Płatnik desktop client (CPE cpe:2.3:a:zakład_ubezpieczeń_społecznych:płatnik:*:*:*:*:*:*:*:*), which stores account configuration - including credentials used for ZUS e-services - locally and may also transmit them; certificate-based signing and transmission of insurance documents are the surrounding use case, but the affected asset here is the encoded password material itself, not the cryptography used for document submission. Because the scheme is reversible rather than a salted, slow hash, no brute-force effort is required once the encoded value is in hand; the practical barrier is gaining read access to the stored value or a position to intercept it, which is why the independent assessment scores the attack as local (AV:L) with low privileges (PR:L) and confidentiality-only impact, rather than the adjacent-network, high-attack-complexity profile in the supplied CVSS 4.0 vector. The trigger for reaching the encoded value is not described in the available sources.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Decoding is trivial once the encoded password is obtained (AC:L), but obtaining it needs prior local access to stored credentials (AV:L/PR:L); direct impact is disclosure of the credential, so C:H, I:N, A:N.
Primary rating from Vendor (CERT-PL).
CVSS VectorVendor: CERT-PL
DescriptionCVE.org
Use of a weak password encoding algorithm in Płatnik software allows a user who obtains encoded password to easily decode it.
This issue was fixed in metric 242 in version 10.02.002.
Executive ViewAI
Płatnik, the ZUS client used for social insurance submissions, stores credentials using a reversible encoding scheme, allowing anyone who obtains the encoded data to recover plaintext passwords. This affects organizations relying on Płatnik up to version 10.02.002 and could expose sensitive authentication credentials, potentially leading to unauthorized access to insurance accounts and data breaches.
No vendor-released patch identified at time of analysis. Interim mitigations include restricting access to encoded credential storage locations, encrypting configuration files, and monitoring for unauthorized access.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Exploit-DB