Is there a patch available for EUVD-2026-33664?

Yes, a patch is available for EUVD-2026-33664. Update the affected software to the latest version immediately.

Sulu CMS EUVD-2026-33664

Q: What is the CVSS score of EUVD-2026-33664?

EUVD-2026-33664 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.0%.

| CVE-2026-45701 MEDIUM

Use of a Broken or Risky Cryptographic Algorithm (CWE-327)

2026-05-18 https://github.com/sulu/sulu

GHSA-7fv8-6pp7-6h85

PHP Information Disclosure

6.9

CVSS 4.0 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

CVSS changed

Jun 01, 2026 - 17:22 NVD

6.9 (MEDIUM)

Source Code Evidence Fetched

May 18, 2026 - 18:02 vuln.today

Analysis Generated

May 18, 2026 - 18:02 vuln.today

DescriptionGitHub Advisory

Impact

The password reset tokenand API key generation uses a weak cryptographical hash algorithm.

Patches

Fixed in 2.6.23 and 3.0.6 version.

Workarounds

Patch the related User.php and ResettingController.php file in the SecurityBundle.

AnalysisAI

Weak cryptographic algorithm usage in Sulu CMS exposes password reset tokens and API keys to prediction or brute-force attacks, potentially enabling unauthorized account takeover or API access. The flaw resides in the SecurityBundle's User.php and ResettingController.php, affecting all Sulu 2.x releases up to 2.6.22 and all 3.x releases from the first alpha through 3.0.5. No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV, but the cryptographic weakness (CWE-327) is structurally exploitable by a motivated attacker with network access to the application.

Technical ContextAI

Sulu is a PHP-based content management platform distributed via Composer (pkg:composer/sulu/sulu). The vulnerability stems from CWE-327 - Use of a Broken or Risky Cryptographic Algorithm - specifically in two files within the SecurityBundle: User.php (responsible for API key generation) and ResettingController.php (responsible for password reset token generation). When a cryptographically weak algorithm (e.g., MD5, SHA-1, or an insufficiently seeded PRNG) is used to generate these sensitive tokens, an attacker may be able to predict, reproduce, or brute-force valid tokens within a feasible time window. The dual impact - both API keys and password reset flows - means the attack surface covers both programmatic integrations and human user account recovery mechanisms.

RemediationAI

The primary fix is to upgrade sulu/sulu to version 2.6.23 (for 2.x deployments) or 3.0.6 (for 3.x deployments) via Composer: run 'composer update sulu/sulu' and confirm the resolved version. Release notes and upgrade guidance for 2.6.23 are available at https://github.com/sulu/sulu/releases/tag/2.6.23, including a skeleton comparison and breaking changes log. For deployments where an immediate upgrade is not feasible, the vendor-documented workaround is to manually patch User.php and ResettingController.php within the SecurityBundle to replace the weak cryptographic algorithm with a cryptographically secure alternative (e.g., using PHP's random_bytes() or a strong HMAC). Manual patching carries the trade-off of diverging from upstream and creating a maintenance burden at the next upgrade; it should be treated as a temporary measure only. Additionally, consider rotating all existing API keys and invalidating outstanding password reset tokens after patching, as any previously generated values may be compromised.