CWE-916
AllowedUse of Password Hash With Insufficient Computational Effort
Abstraction: Base · Status: Incomplete
The product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive.
191 vulnerabilities reference this CWE, most recent first.
GHSA-275F-JQ4P-WXGW
Vulnerability from github – Published: 2022-05-24 17:44 – Updated: 2026-07-05 00:31Fluxbb 1.5.11 is affected by a denial of service (DoS) vulnerability by sending an extremely long password via the user login form. When a long password is sent, the password hashing process will result in CPU and memory exhaustion on the server.
{
"affected": [],
"aliases": [
"CVE-2020-28873"
],
"database_specific": {
"cwe_ids": [
"CWE-916"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-03-17T13:15:00Z",
"severity": "HIGH"
},
"details": "Fluxbb 1.5.11 is affected by a denial of service (DoS) vulnerability by sending an extremely long password via the user login form. When a long password is sent, the password hashing process will result in CPU and memory exhaustion on the server.",
"id": "GHSA-275f-jq4p-wxgw",
"modified": "2026-07-05T00:31:17Z",
"published": "2022-05-24T17:44:42Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28873"
},
{
"type": "WEB",
"url": "https://www.acunetix.com/vulnerabilities/web/long-password-denial-of-service/#:~:text=By%20sending%20a%20very%20long%2Ca%20vulnerable%20password%20hashing%20implementation"
},
{
"type": "WEB",
"url": "https://www.acunetix.com/vulnerabilities/web/long-password-denial-of-service/#:~:text=By%20sending%20a%20very%20long,a%20vulnerable%20password%20hashing%20implementation"
},
{
"type": "WEB",
"url": "http://fluxbb.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-2GV7-CC99-M2PR
Vulnerability from github – Published: 2025-01-29 03:31 – Updated: 2025-01-29 03:31IBM Security Verify Governance 10.0.2 Identity Manager
uses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the product does not also use a salt as part of the input.
{
"affected": [],
"aliases": [
"CVE-2023-33838"
],
"database_specific": {
"cwe_ids": [
"CWE-759",
"CWE-916"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-29T02:15:26Z",
"severity": "MODERATE"
},
"details": "IBM Security Verify Governance 10.0.2 Identity Manager \n\nuses a one-way cryptographic hash against an input that should not be reversible, such as a password, but the product does not also use a salt as part of the input.",
"id": "GHSA-2gv7-cc99-m2pr",
"modified": "2025-01-29T03:31:48Z",
"published": "2025-01-29T03:31:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-33838"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7172200"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-2Q8J-P5MW-6MF5
Vulnerability from github – Published: 2025-12-16 21:30 – Updated: 2025-12-16 21:30Insecure defaults in the Server Agent component of Fortra's Core Privileged Access Manager (BoKS) can result in the selection of weak password hash algorithms. This issue affects BoKS Server Agent 9.0 instances that support yescrypt and are running in a BoKS 8.1 domain.
{
"affected": [],
"aliases": [
"CVE-2025-13532"
],
"database_specific": {
"cwe_ids": [
"CWE-916"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-16T20:15:47Z",
"severity": "MODERATE"
},
"details": "Insecure defaults in the Server Agent component of Fortra\u0027s Core Privileged Access Manager (BoKS) can result in the selection of weak password hash algorithms. \u00a0This issue affects BoKS Server Agent 9.0 instances that support yescrypt and are running in a BoKS 8.1 domain.",
"id": "GHSA-2q8j-p5mw-6mf5",
"modified": "2025-12-16T21:30:55Z",
"published": "2025-12-16T21:30:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13532"
},
{
"type": "WEB",
"url": "https://www.fortra.com/security/advisories/product-security/fi-2025-014"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-32FF-4G79-VGFC
Vulnerability from github – Published: 2022-07-29 22:28 – Updated: 2025-03-07 19:09Impact
An authenticated Admin user could craft HTTP requests to filter users by their salted and hashed passwords strings. These filters could be made by using partial hashed password strings. The response would not include the hashed passwords, but an attacker could infer partial password hashes and their respective users.
Only when using AUTH_DB database authentication option.
Patches
Fixed on 4.1.3
For more information
If you have any questions or comments about this advisory: * Open an issue in example link to repo * Email us at example email address
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "Flask-AppBuilder"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.1.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-31177"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-916"
],
"github_reviewed": true,
"github_reviewed_at": "2022-07-29T22:28:12Z",
"nvd_published_at": "2022-08-01T19:15:00Z",
"severity": "LOW"
},
"details": "### Impact\nAn authenticated Admin user could craft HTTP requests to filter users by their salted and hashed passwords strings. These filters could be made by using partial hashed password strings. The response would not include the hashed passwords, but an attacker could infer partial password hashes and their respective users.\n\nOnly when using `AUTH_DB` database authentication option.\n\n### Patches\nFixed on 4.1.3\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [example link to repo](http://example.com)\n* Email us at [example email address](mailto:example@example.com)",
"id": "GHSA-32ff-4g79-vgfc",
"modified": "2025-03-07T19:09:38Z",
"published": "2022-07-29T22:28:12Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/dpgaspar/Flask-AppBuilder/security/advisories/GHSA-32ff-4g79-vgfc"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31177"
},
{
"type": "PACKAGE",
"url": "https://github.com/dpgaspar/Flask-AppBuilder"
},
{
"type": "WEB",
"url": "https://github.com/dpgaspar/Flask-AppBuilder/releases/tag/v4.1.3"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/flask-appbuilder/PYSEC-2022-247.yaml"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Flask-AppBuilder before v4.1.3 allows inference of sensitive information through query strings"
}
GHSA-335Q-V5R7-XQ5P
Vulnerability from github – Published: 2023-02-16 21:30 – Updated: 2023-02-25 00:30A use of password hash with insufficient computational effort vulnerability [CWE-916] in FortiSandbox before 4.2.0 may allow an attacker with access to the password database to efficiently mount bulk guessing attacks to recover the passwords.
{
"affected": [],
"aliases": [
"CVE-2022-26115"
],
"database_specific": {
"cwe_ids": [
"CWE-916"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-02-16T19:15:00Z",
"severity": "HIGH"
},
"details": "A use of password hash with insufficient computational effort vulnerability [CWE-916] in FortiSandbox before 4.2.0 may allow an attacker with access to the password database to efficiently mount bulk guessing attacks to recover the passwords.",
"id": "GHSA-335q-v5r7-xq5p",
"modified": "2023-02-25T00:30:46Z",
"published": "2023-02-16T21:30:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-26115"
},
{
"type": "WEB",
"url": "https://fortiguard.com/psirt/FG-IR-20-220"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-35M5-8CVJ-8783
Vulnerability from github – Published: 2021-11-10 16:28 – Updated: 2024-09-20 16:50Impact
The vulnerability is we used MD5 hashing Algorithm In our hashing file. If anyone who is a beginner(and doesn't know about hashes) can face problems as MD5 is considered a Insecure Hashing Algorithm.
Patches
The vulnerability is patched in v1.1.4 of the product, the users can upgrade to version 1.1.4.
Workarounds
If u specifically want a version and don't want to upgrade, you can remove the MD5 hashing function from the file hashing.py and this vulnerability will be gone
References
https://www.cybersecurity-help.cz/vdb/cwe/916/ https://www.cybersecurity-help.cz/vdb/cwe/327/ https://www.cybersecurity-help.cz/vdb/cwe/328/ https://www.section.io/engineering-education/what-is-md5/ https://www.johndcook.com/blog/2019/01/24/reversing-an-md5-hash/
For more information
If you have any questions or comments about this advisory: * Open an issue in Enrocrypt's Official Repo * Create a Discussion in Enrocrypt's Official Repo
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "enrocrypt"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.1.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-39182"
],
"database_specific": {
"cwe_ids": [
"CWE-326",
"CWE-327",
"CWE-328",
"CWE-916"
],
"github_reviewed": true,
"github_reviewed_at": "2021-11-08T18:58:04Z",
"nvd_published_at": "2021-11-08T15:15:00Z",
"severity": "HIGH"
},
"details": "### Impact\nThe vulnerability is we used MD5 hashing Algorithm In our hashing file. If anyone who is a beginner(and doesn\u0027t know about hashes) can face problems as MD5 is considered a Insecure Hashing Algorithm. \n\n### Patches\nThe vulnerability is patched in v1.1.4 of the product, the users can upgrade to version 1.1.4.\n\n### Workarounds\nIf u specifically want a version and don\u0027t want to upgrade, you can remove the `MD5` hashing function from the file `hashing.py` and this vulnerability will be gone\n\n### References\nhttps://www.cybersecurity-help.cz/vdb/cwe/916/\nhttps://www.cybersecurity-help.cz/vdb/cwe/327/\nhttps://www.cybersecurity-help.cz/vdb/cwe/328/\nhttps://www.section.io/engineering-education/what-is-md5/\nhttps://www.johndcook.com/blog/2019/01/24/reversing-an-md5-hash/\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [**Enrocrypt\u0027s Official Repo**](http://www.github.com/Morgan-Phoenix/EnroCrypt)\n* Create a Discussion in [**Enrocrypt\u0027s Official Repo**](http://www.github.com/Morgan-Phoenix/EnroCrypt)\n",
"id": "GHSA-35m5-8cvj-8783",
"modified": "2024-09-20T16:50:32Z",
"published": "2021-11-10T16:28:46Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/Morgan-Phoenix/EnroCrypt/security/advisories/GHSA-35m5-8cvj-8783"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39182"
},
{
"type": "WEB",
"url": "https://github.com/Morgan-Phoenix/EnroCrypt/commit/e652d56ac60eadfc26489ab83927af13a9b9d8ce"
},
{
"type": "PACKAGE",
"url": "https://github.com/Morgan-Phoenix/EnroCrypt"
},
{
"type": "WEB",
"url": "https://github.com/pypa/advisory-database/tree/main/vulns/enrocrypt/PYSEC-2021-385.yaml"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Improper hashing in enrocrypt"
}
GHSA-35QW-39FH-853X
Vulnerability from github – Published: 2022-05-24 19:12 – Updated: 2022-05-24 19:12Delta Electronics DIAEnergie Version 1.7.5 and prior may allow an attacker to retrieve passwords in cleartext due to a weak hashing algorithm.
{
"affected": [],
"aliases": [
"CVE-2021-33003"
],
"database_specific": {
"cwe_ids": [
"CWE-327",
"CWE-916"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-08-30T18:15:00Z",
"severity": "MODERATE"
},
"details": "Delta Electronics DIAEnergie Version 1.7.5 and prior may allow an attacker to retrieve passwords in cleartext due to a weak hashing algorithm.",
"id": "GHSA-35qw-39fh-853x",
"modified": "2022-05-24T19:12:28Z",
"published": "2022-05-24T19:12:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-33003"
},
{
"type": "WEB",
"url": "https://us-cert.cisa.gov/ics/advisories/icsa-21-238-03"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-3MM6-HC5R-P5RX
Vulnerability from github – Published: 2022-05-13 01:05 – Updated: 2022-05-13 01:05Premisys Identicard version 3.1.190 stores user credentials and other sensitive information with a known weak encryption method (MD5 hash of a salt and password).
{
"affected": [],
"aliases": [
"CVE-2019-3907"
],
"database_specific": {
"cwe_ids": [
"CWE-916"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-01-18T18:29:00Z",
"severity": "HIGH"
},
"details": "Premisys Identicard version 3.1.190 stores user credentials and other sensitive information with a known weak encryption method (MD5 hash of a salt and password).",
"id": "GHSA-3mm6-hc5r-p5rx",
"modified": "2022-05-13T01:05:22Z",
"published": "2022-05-13T01:05:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-3907"
},
{
"type": "WEB",
"url": "https://www.tenable.com/security/research/tra-2019-01"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/106552"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-3P7G-WRGG-WQ45
Vulnerability from github – Published: 2022-11-10 21:35 – Updated: 2022-11-10 21:35Impact
Unauthenticated GraphQL queries for user accounts can expose password hashes of users that have created or modified content, typically but not necessarily limited to administrators and editors.
Patches
Affected versions: Ibexa DXP v3.3.*, v4.2.*, eZ Platform v2.5.* Resolving versions: Ibexa DXP v3.3.28, v4.2.3, eZ Platform v2.5.31
Workarounds
Remove the "passwordHash" entry from "src/bundle/Resources/config/graphql/User.types.yaml" in the GraphQL package, and other properties like hash type, email, login if you prefer.
References
This issue was reported to us by Philippe Tranca ("trancap") of the company Lexfo. We are very grateful for their research, and responsible disclosure to us of this critical vulnerability.
For more information
If you have any questions or comments about this advisory, please contact Support via your service portal.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "ibexa/graphql"
},
"ranges": [
{
"events": [
{
"introduced": "2.5.0"
},
{
"fixed": "2.5.31"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "ibexa/graphql"
},
"ranges": [
{
"events": [
{
"introduced": "4.2.0"
},
{
"fixed": "4.2.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Packagist",
"name": "ibexa/graphql"
},
"ranges": [
{
"events": [
{
"introduced": "3.3.0"
},
{
"fixed": "3.3.28"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-916"
],
"github_reviewed": true,
"github_reviewed_at": "2022-11-10T21:35:49Z",
"nvd_published_at": null,
"severity": "CRITICAL"
},
"details": "### Impact\nUnauthenticated GraphQL queries for user accounts can expose password hashes of users that have created or modified content, typically but not necessarily limited to administrators and editors.\n\n### Patches\nAffected versions: Ibexa DXP v3.3.\\*, v4.2.\\*, eZ Platform v2.5.\\*\nResolving versions: Ibexa DXP v3.3.28, v4.2.3, eZ Platform v2.5.31\n\n### Workarounds\nRemove the \"passwordHash\" entry from \"src/bundle/Resources/config/graphql/User.types.yaml\" in the GraphQL package, and other properties like hash type, email, login if you prefer.\n\n### References\n\nThis issue was reported to us by Philippe Tranca (\"trancap\") of the company Lexfo. We are very grateful for their research, and responsible disclosure to us of this critical vulnerability. \n\n### For more information\nIf you have any questions or comments about this advisory, please contact Support via your service portal.",
"id": "GHSA-3p7g-wrgg-wq45",
"modified": "2022-11-10T21:35:49Z",
"published": "2022-11-10T21:35:49Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/ibexa/graphql/security/advisories/GHSA-3p7g-wrgg-wq45"
},
{
"type": "WEB",
"url": "https://github.com/ibexa/graphql/commit/5ae5fb4d1d292ddde8528e040ef8a7c8dd7f9c6d"
},
{
"type": "WEB",
"url": "https://developers.ibexa.co/security-advisories/ibexa-sa-2022-009-critical-vulnerabilities-in-graphql-role-assignment-ct-editing-and-drafts-tooltips"
},
{
"type": "PACKAGE",
"url": "https://github.com/ibexa/graphql"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "GraphQL queries can expose password hashes"
}
GHSA-3VHW-PG83-CF2W
Vulnerability from github – Published: 2026-08-07 06:30 – Updated: 2026-08-07 06:30The root password hash of the device can be obtained through unencrypted information in the firmware.
{
"affected": [],
"aliases": [
"CVE-2026-49005"
],
"database_specific": {
"cwe_ids": [
"CWE-916"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-07T05:17:02Z",
"severity": "LOW"
},
"details": "The root password hash of the device can be obtained through unencrypted information in the firmware.",
"id": "GHSA-3vhw-pg83-cf2w",
"modified": "2026-08-07T06:30:28Z",
"published": "2026-08-07T06:30:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-49005"
},
{
"type": "WEB",
"url": "https://support.zte.com.cn/zte-iccp-isupport-webui/bulletin/detail/7458768768701636680"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation MIT-51
- Use an adaptive hash function that can be configured to change the amount of computational effort needed to compute the hash, such as the number of iterations ("stretching") or the amount of memory required. Some hash functions perform salting automatically. These functions can significantly increase the overhead for a brute force attack compared to intentionally-fast functions such as MD5. For example, rainbow table attacks can become infeasible due to the high computing overhead. Finally, since computing power gets faster and cheaper over time, the technique can be reconfigured to increase the workload without forcing an entire replacement of the algorithm in use.
- Some hash functions that have one or more of these desired properties include bcrypt [REF-291], scrypt [REF-292], and PBKDF2 [REF-293]. While there is active debate about which of these is the most effective, they are all stronger than using salts with hash functions with very little computing overhead.
- Note that using these functions can have an impact on performance, so they require special consideration to avoid denial-of-service attacks. However, their configurability provides finer control over how much CPU and memory is used, so it could be adjusted to suit the environment's needs.
Mitigation MIT-25
When using industry-approved techniques, use them correctly. Don't cut corners by skipping resource-intensive steps (CWE-325). These steps are often essential for preventing common attacks.
CAPEC-55: Rainbow Table Password Cracking
An attacker gets access to the database table where hashes of passwords are stored. They then use a rainbow table of pre-computed hash chains to attempt to look up the original password. Once the original password corresponding to the hash is obtained, the attacker uses the original password to gain access to the system.