CVE-2026-110104
Description
A flaw was found in novel. The application stores user account passwords using unsalted Message Digest 5 (MD5) hashes during registration rather than a modern, secure hashing algorithm. An attacker who obtains the database records or backup files can rapidly crack these hashes using brute-force techniques or precomputed lookup tables, leading to the exposure and potential reuse of plaintext user credentials.
Statement
Red Hat rates this vulnerability as Moderate because successful exploitation requires prior unauthorized access to the database or system backups to obtain the password hashes. Without direct access to the stored credentials, the weak hashing mechanism cannot be exploited independently over the network. Additionally, the affected software is not shipped or supported in Red Hat products.
Understanding the Weakness (CWE)
Access Control
Technical Impact: Bypass Protection Mechanism; Gain Privileges or Assume Identity
If an attacker can gain access to the hashes, then the lack of sufficient computational effort will make it easier to conduct brute force attacks using techniques such as rainbow tables, or specialized hardware such as GPUs, which can be much faster than general-purpose CPUs for computing hashes.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
