CVE-2026-26219

Newbee-Mall uses an unsalted MD5 algorithm to hash user passwords, without any per-user salt or mechanisms to increase computational cost (e.g., iterations). When an attacker gains access to password hashes — for example through a database leak, backup disclosure, or other compromise vector — they can perform an offline attack (e.g., using rainbow tables or dictionary attacks) to recover the original passwords in plain text in a short time. The lack of salt additionally enables simultaneous cracking of multiple hashes at once.

An attacker who obtains password hashes can recover the original authentication credentials of users and gain unauthorized access to their accounts. Recovered passwords can also be used for credential stuffing attacks on other services if users reuse the same passwords in multiple places.

Apply patches available from the vendor according to the references provided. Migration to secure password hashing algorithms (e.g., bcrypt, Argon2, or scrypt) is recommended, with a unique salt applied for each user and appropriate computational cost. After implementing the patch, users should be forced to change their passwords.

Newbee-Mall project (newbee-ltd/newbee-mall) — versions indicated in the vendor's references