{"id":"CVE-2026-112029","kind":"vulnerability","aliases":["CVE-2026-112029"],"related":[],"title":"diem: SHA1 password hashing with insufficient effort in PluginDmUser model","description":"A vulnerability has been found in diem-project diem up to 5.1.3. This affects an unknown part of the file lib/model/doctrine/PluginDmUser.class.php of the component SHA1 Handler. Such manipulation of the argument salt/password leads to password hash with insufficient computational effort. The attack needs to be performed locally. The attack requires a high level of complexity. It is indicated that the exploitability is difficult. The exploit has been disclosed to the public and may be used. The project was informed of the problem early through an issue report but has not responded yet.","summary":"The diem project's PluginDmUser model hashes passwords with SHA1 using an unsafe salt and password handling path, so a stored hash is weak. An attacker with local access who obtains the hash data could attempt to crack passwords more easily.","severity":"low","cvss":2.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["diem","package","php","self-hosted"],"not_affected_if":["default-config"],"how_to_check":"- Check the diem version in use; the affected range is up to and including `5.1.3`.\n- Look at `lib/model/doctrine/PluginDmUser.class.php` for the SHA1 password hashing code.","fix":"- unknown","status":"open","published_at":"2026-10-18T23:16:56+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T04:49:37+00:00","updated_at":"2026-10-25T04:49:37+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:49:37Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"local","title":"diem: SHA1 password hashing with insufficient effort in PluginDmUser model","impact":"low","summary":"The diem project's PluginDmUser model hashes passwords with SHA1 using an unsafe salt and password handling path, so a stored hash is weak. An attacker with local access who obtains the hash data could attempt to crack passwords more easily.","category":"package","nicknames":[],"who_cares":["diem","php","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Stored password hashes are weaker and easier to crack offline","analyst_note":"Confirm whether a fixed diem version exists and whether the project has responded to the issue report, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-112029.","how_to_check":"- Check the diem version in use; the affected range is up to and including `5.1.3`.\n- Look at `lib/model/doctrine/PluginDmUser.class.php` for the SHA1 password hashing code.","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Teams running the diem project up to and including `5.1.3` where user password hashes are stored with this SHA1 handler. The sources do not say whether a fixed version exists. Deployments on other versions or without this plugin's user model are not indicated as affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000596,"input_tokens":3384,"output_tokens":516,"severity_before":"low"},"analyst_status":null,"analyst_note":null,"search":"'-112029':13A,16A '-2026':12A,15A '5.1.3':76C 'access':51B 'affect':78C 'argument':95C 'attack':48B,106C,113C 'attempt':58B 'complex':119C 'compon':88C 'comput':103C 'could':57B 'crack':60B 'cve':11A,14A 'data':56B 'diem':1A,17B,24B,71C,73C 'diem-project':70C 'difficult':127C 'disclos':132C 'earli':147C 'easili':63B 'effort':7A,104C 'exploit':125C,129C 'file':84C 'found':68C 'handl':39B 'handler':90C 'hash':4A,29B,44B,55B,100C 'high':116C 'host':22B 'indic':122C 'inform':143C 'insuffici':6A,102C 'issu':150C 'lead':97C 'level':117C 'lib/model/doctrine/plugindmuser.class.php':85C 'local':50B,111C 'manipul':92C 'may':137C 'model':10A,28B 'need':107C 'obtain':53B 'packag':18B 'part':81C 'password':3A,30B,38B,61B,99C 'path':40B 'perform':110C 'php':19B 'plugindmus':9A,27B 'problem':146C 'project':25B,72C,141C 'public':135C 'report':151C 'requir':114C 'respond':155C 'salt':36B 'salt/password':96C 'self':21B 'self-host':20B 'sha1':2A,32B,89C 'store':43B 'unknown':80C 'unsaf':35B 'use':33B,139C 'vulner':65C 'weak':46B 'yet':156C","nicknames":[],"mitigations":[],"who_affected":"Teams running the diem project up to and including `5.1.3` where user password hashes are stored with this SHA1 handler. The sources do not say whether a fixed version exists. Deployments on other versions or without this plugin's user model are not indicated as affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T23:16:56+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:L/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-112029","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-112029","severity":null,"published_at":"2026-10-18T23:16:56+00:00","modified_at":"2026-10-19T18:17:01+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}