Vulnerability · Published Feb 12, 2026 · Assigned by VulnCheck
CVE-2026-26219newbee-mall Unsalted MD5 Password Hashing Enables Offline Credential Cracking
Critical 9.1
In plain English
A critical-severity broken cryptography in newbee-mall from newbee-ltd. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 13% of all known vulnerabilities).
Official description
newbee-mall stores and verifies user passwords using an unsalted MD5 hashing algorithm. The implementation does not incorporate per-user salts or computational cost controls, enabling attackers who obtain password hashes through database exposure, backup leakage, or other compromise vectors to rapidly recover plaintext credentials via offline attacks.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| newbee-ltd | newbee-mall | 1.0.0 |
Weakness: CWE-327 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N