Vulnerability · Published Aug 27, 2026 · Assigned by VulnCheck

CVE-2026-80211FrontAccounting through 2.4.20 Use of Unsalted MD5 for Password Storage

Medium 5.9

In plain English

A medium-severity security flaw in FrontAccounting from FrontAccounting. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities).

Severity (CVSS 3.1)5.9Medium

Exploit odds (30 days)0.3%top 76.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

FrontAccounting through 2.4.20 stores and verifies user passwords as unsalted MD5 digests. admin/users.php passes md5($_POST['password']) to add_user() and update_user_password(), admin/change_current_user_password.php does the same when a user changes their own password, the forgotten-password path in includes/current_user.inc hashes the newly generated password the same way, and authentication calls get_user_auth($loginname, md5($password)). The codebase applies no per-password salt and contains no call to password_hash(), password_verify() or any other adaptive hash, so identical passwords yield identical digests and an attacker who obtains the user table can recover plaintext passwords with precomputed lookup tables or high-rate GPU cracking.

Affected products (as reported)

Vendor	Product	Versions
FrontAccounting	FrontAccounting	0 – through 2.4.20

Weakness: CWE-916 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

References

geo-chen/oss: FrontAccounting Finding 2 third-party-advisory
https://github.com/FrontAccountingERP/FA product
https://github.com/FrontAccountingERP/FA/blob/9464a3ffef03c139d9396e697bce9a0a9f131a72/includes/current_user.inc#L79 technical-description
VulnCheck Advisory: FrontAccounting through 2.4.20 Use of Unsalted MD5 for Password Storage third-party-advisory