Vulnerability · Published Mar 19, 2025 · Assigned by ENISA

CVE-2025-26486

Medium 6.0

In plain English

A medium-severity broken cryptography in Life 1st from Beta80. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 2% of all known vulnerabilities).

Severity (CVSS 3.1)6.0Medium

Exploit odds (30 days)0.1%top 98.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Broken or Risky Cryptographic Algorithm, Use of Password Hash With Insufficient Computational Effort, Use of Weak Hash, Use of a One-Way Hash with a Predictable Salt vulnerabilities in Beta80 "Life 1st Identity Manager" enable an attacker with access to password hashes to bruteforce user passwords or find a collision to ultimately while attempting to gain access to a target application that uses "Life 1st Identity Manager" as a service for authentication. This issue affects Life 1st: 1.5.2.14234.

Affected products (as reported)

Vendor	Product	Versions
Beta80	Life 1st	1.5.2.14234

Weakness: CWE-327, CWE-916, CWE-328, CWE-760 · Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

References

https://www.cvcn.gov.it/cvcn/cve/CVE-2025-26486 government-resource
https://euvd.enisa.europa.eu/vulnerability/CVE-2025-26486 vdb-entry