EUVD-2026-40294
GHSA-92mj-xr7p-2g9c
Severity by source
CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:L because cracking occurs on the attacker's local system using obtained hashes; AC:L and PR:N since rainbow table attacks require no privileges and trivial tooling; no integrity or availability impact applies.
Primary rating from Vendor (CERT-PL).
CVSS VectorVendor: CERT-PL
Lifecycle Timeline
1DescriptionCVE.org
Redeight CMS version 1.0 uses the MD5 algorithm without a salt to store user passwords. Because MD5 is a cryptographically broken algorithm and lacks salting, attackers who obtain the password hashes can trivially reverse them using rainbow tables, leading to the exposure of plaintext credentials.
AnalysisAI
Redeight CMS 1.0 stores user passwords using unsalted MD5 hashes, enabling any attacker who obtains the credential database to recover plaintext passwords nearly instantaneously via precomputed rainbow tables. All stored credentials are effectively exposed upon database compromise, since MD5 is cryptographically broken and the absence of per-user salts eliminates hash uniqueness across identical passwords. No public exploit code or confirmed active exploitation has been identified at time of analysis, but the cracking technique is trivially automated and requires no specialized skill.
Technical ContextAI
This vulnerability is classified as CWE-261 (Weak Cryptography for Passwords), arising from two compounding weaknesses: use of MD5, a hash function considered cryptographically broken since the mid-2000s, combined with the complete absence of a cryptographic salt. MD5 produces deterministic 128-bit digests, meaning two users with the same password generate identical hashes. Without per-user salts, precomputed rainbow tables covering common password spaces can reverse hashes in seconds to minutes using widely available tooling. Modern standards - NIST SP 800-63B and OWASP ASVS - mandate adaptive, salted algorithms such as bcrypt, scrypt, or Argon2id, which are designed to be computationally expensive and resistant to precomputation attacks. The affected product is identified via CPE cpe:2.3:a:redeight:redeight_cms:*:*:*:*:*:*:*:*, with version 1.0 explicitly named in the disclosure.
RemediationAI
No vendor-released patch has been identified at time of analysis. Administrators should treat all existing MD5 password hashes in the database as compromised and force a password reset for all users at next login. The application's password storage mechanism must be replaced with a modern adaptive algorithm - Argon2id is the current OWASP recommendation, with bcrypt or scrypt as acceptable alternatives - incorporating per-user cryptographically random salts of at least 16 bytes. A transparent migration strategy (re-hash on successful login) can be implemented to avoid disrupting all users simultaneously, but should be paired with a hard deadline after which un-migrated accounts are locked. As compensating controls pending a code fix: restrict database access to the application service account only, disable remote database connectivity, rotate database credentials immediately, and audit access logs for evidence of prior unauthorized database reads. Refer to the CERT-PL advisory at https://cert.pl/posts/2026/06/CVE-2026-53690 for any vendor-specific guidance.
More in Redeight Cms
View allSQL injection in Redeight CMS 1.0 lets unauthenticated remote attackers extract sensitive database contents by injecting
Remote code execution in Redeight CMS 1.0 lets an authenticated attacker upload arbitrary PHP scripts through the admin
Same weakness CWE-261 – Weak Encoding for Password
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today