Live › vulnerability › CVE-2026-112029
Go to dashboardThe diem project's PluginDmUser model hashes passwords with SHA1 using an unsafe salt and password handling path, so a stored hash is weak. An attacker with local access who obtains the hash data could attempt to crack passwords more easily.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running the diem project up to and including where user password hashes are stored with this SHA1 handler. The sources do not say whether a fixed version exists. Deployments on other versions or without this plugin's user model are not indicated as affected.
5.1.3No product ranges from the sources yet.
5.1.3.lib/model/doctrine/PluginDmUser.class.php for the SHA1 password hashing code.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability has been found in diem-project diem up to 5.1.3. This affects an unknown part of the file lib/model/doctrine/PluginDmUser.class.php of the component SHA1 Handler. Such manipulation of the argument salt/password leads to password hash with insufficient computational effort. The attack needs to be performed locally. The attack requires a high level of complexity. It is indicated that the exploitability is difficult. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.
This page as .md · .json · in your agent: get_signal("CVE-2026-112029")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.