EUVD-2026-63578
GHSA-m3r5-hc33-p4wf
Severity by source
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AV:N retained as the app is network-accessible; AC:H reflects the mandatory secondary breach to obtain hashes; C:L as credential recovery is partial and depends on password strength.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
A security flaw has been discovered in lin-snow Ech0 up to 5.4.1. Affected by this issue is the function MD5Encrypt of the file internal/util/crypto/crypto.go. Performing a manipulation results in risky cryptographic algorithm. Remote exploitation of the attack is possible. The complexity of an attack is rather high. The exploitation is known to be difficult. Upgrading to version 5.4.2 can resolve this issue. The patch is named 9ce19a3b0d0765086a655f45d3a706ec1810404f. It is recommended to upgrade the affected component.
AnalysisAI
Unsalted MD5 password hashing in Ech0's MD5Encrypt function (internal/util/crypto/crypto.go) stores credentials in a format trivially crackable via rainbow tables or GPU-accelerated brute force. Versions 5.4.0 and 5.4.1 are confirmed affected; the migration comment in the fix explicitly labels the stored values as 'historical bare MD5' (历史裸 MD5), confirming no per-user salt was applied. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires prior read access to the Ech0 database (SQLite file or raw database query capability) obtained through a separate vulnerability or misconfiguration - this CVE does not provide that access on its own. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 6.3 (AV:N/AC:H/PR:N/UI:N/VC:L) accurately reflects the chained nature of this vulnerability: an attacker cannot exploit the weak hash directly over the network; they must first obtain the hash values through a secondary vector such as database file exposure, path traversal, or backup leak. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who obtains the Ech0 SQLite database file - for instance through a misconfigured web server exposing the data directory, a separate path traversal vulnerability, or an exfiltrated backup - extracts the `users.password` column containing unsalted MD5 hashes and submits them to an offline hashcat session against a common wordlist or precomputed rainbow table. Because no per-user salt was applied, a single table lookup cracks matching hashes across all accounts simultaneously. … |
| Remediation | Upgrade to Ech0 5.4.2, confirmed released at https://github.com/lin-snow/Ech0/releases/tag/ech0-5.4.2 (patch commit 9ce19a3b0d0765086a655f45d3a706ec1810404f, PR #315 at https://github.com/lin-snow/Ech0/pull/315). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Persistent authentication bypass in Ech0 (lin-snow's self-hosted lightweight publishing/memo app) before 4.7.3 lets an a
OAuth redirect URI validation in Ech0 through 4.5.6 allows session hijacking via exchange-code theft by exploiting incom
Denial of service in Ech0 before 5.0.1 allows unauthenticated remote attackers to saturate server CPU by exploiting a qu
Authorization bypass in Ech0 before 4.5.1 allows any authenticated non-admin user to invoke privileged admin endpoints b
Privilege escalation in Ech0 before 4.4.3 allows an attacker holding an admin's profile:read access token to change the
Server-side request forgery in Ech0 before version 4.7.3 allows authenticated users to pivot through the application ser
Scope enforcement in Ech0 4.3.4 and earlier is opt-in at the route level, meaning privileged admin routes that omit the
Missing administrator authorization on dashboard log endpoints in Ech0 before 4.4.3 allows any authenticated low-privile
Scope enforcement bypass in Ech0's comment panel admin API allows any holder of a valid admin-issued access token - rega
Unauthenticated metric inflation in Ech0 before 4.7.3 allows any remote attacker to arbitrarily increment the fav_count
Unauthenticated remote attackers can increment the fav_count of any echo - including private ones - in Ech0 through 4.5.
Ech0 before version 4.7.3 exposes guest commenter email addresses to unauthenticated remote callers via public comment-l
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today