research-cve-2026-85649

CVE-2026-85649 | Holloway Chew, Kean Ho's Knowledge Research On 2026-08-26, a security vulnerability CVSS: 7.9, High7 was reported in Holloway Chew, Kean Ho's Actualizer v1.2.0 and below. The tool assumed that the mkpasswd command always produces a valid yescrypt password hash. In situations wher...

busybox: busybox: httpd misidentifies yescrypt password hashes as plaintext, inverting authentication

BusyBox httpd treats yescrypt $y$ password hashes as plaintext during Basic Authentication, inverting the authentication check...

Linux Distros Unpatched Vulnerability : CVE-2026-88837

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - BusyBox httpd treats yescrypt $y$ password hashes as plaintext during Basic Authentication, inverting the authentication check. CVE-2026-88837 Note that Nessus...

SUSE CVE-2026-88837

BusyBox httpd treats yescrypt $y$ password hashes as plaintext during Basic Authentication, inverting the authentication check...

CVE-2026-88837

BusyBox httpd treats yescrypt $y$ password hashes as plaintext during Basic Authentication, inverting the authentication check...

DEBIAN-CVE-2026-88837

BusyBox httpd treats yescrypt $y$ password hashes as plaintext during Basic Authentication, inverting the authentication check...

UBUNTU-CVE-2026-88837

BusyBox httpd treats yescrypt $y$ password hashes as plaintext during Basic Authentication, inverting the authentication check...

CVE-2026-88837

BusyBox httpd treats yescrypt $y$ password hashes as plaintext during Basic Authentication, inverting the authentication check...

CVE-2026-88837 Busybox: busybox: httpd misidentifies yescrypt password hashes as plaintext, inverting authentication

BusyBox httpd treats yescrypt $y$ password hashes as plaintext during Basic Authentication, inverting the authentication check...

EUVD-2026-85511

BusyBox httpd treats yescrypt $y$ password hashes as plaintext during Basic Authentication, inverting the authentication check...

CVE-2026-88837

The BusyBox httpd component is vulnerable to an authentication bypass because it incorrectly treats yescrypt ($y$) password hashes as plaintext during Basic Authentication . This flaw inverts the authentication check, potentially allowing unauthorized access. To mitigate this risk, users are advi...

CVE-2026-88837 Busybox: busybox: httpd misidentifies yescrypt password hashes as plaintext, inverting authentication

BusyBox httpd treats yescrypt $y$ password hashes as plaintext during Basic Authentication, inverting the authentication check...

CVE-2026-88837

BusyBox httpd treats yescrypt $y$ password hashes as plaintext during Basic Authentication, inverting the authentication check...

CVE-2026-88837

BusyBox httpd treats yescrypt $y$ password hashes as plaintext during Basic Authentication, inverting the authentication check. Mitigation Do not use BusyBox httpd for password-protected resources. If it must be used, configure authentication with SHA-512 $6$ hashes, which are correctly detected...

CVE-2026-88837: Authentication Bypass by Primary Weakness

BusyBox httpd treats yescrypt $y$ password hashes as plaintext during Basic Authentication, inverting the authentication check...

PT-2026-97428

Name of the Vulnerable Software and Affected Versions BusyBox versions prior to 1.38.0-3.1 Description The httpd component of BusyBox incorrectly processes yescrypt $y$ password hashes during Basic Authentication. Instead of verifying the hash, the system treats it as plaintext, which inverts the...

PT-2026-85524

Holloway Chew, Kean Ho's Actualizer v1.2.0 and earlier contains a fail-open password validation vulnerability in the Alpha user and root user password loops of Shell/debian-minbase-install.sh. The installer invokes mkpasswd to generate yescrypt password hashes but does not check the command's...

CVE-2026-15041

A flaw was found in 389 Directory Server. The PBKDF2-SHA256 password verification function uses standard memcmp for comparing password hashes instead of a constant-time comparison function. A remote attacker could potentially use timing measurements of LDAP bind attempts to infer partial hash...

CVE-2025-13532

Insecure defaults in the Server Agent component of Fortra's Core Privileged Access Manager BoKS can result in the selection of weak password hash algorithms. This issue affects BoKS Server Agent 9.0 instances that support yescrypt and are running in a BoKS 8.1 domain...

EUVD-2025-203842

Insecure defaults in the Server Agent component of Fortra's Core Privileged Access Manager BoKS can result in the selection of weak password hash algorithms. This issue affects BoKS Server Agent 9.0 instances that support yescrypt and are running in a BoKS 8.1 domain...