research-cve-2026-85649

CVE-2026-85649 | Holloway Chew, Kean Ho's Knowledge Research 2026-08-26에 보안 취약점CVSS: 7.9, High7이 Holloway Chew, Kean Ho's Actualizer v1.2.0 이하 버전에서 보고되었습니다. 해당 도구는 mkpasswd 명령이 항상 유효한 yescrypt 비밀번호 해시를 생성한다고 가정했습니다. 설치된 mkpasswd에 yescrypt 지원이 없는 상황에서는 명령이 대신 실패하여 빈 값을 생성합니다. 이 논리 결함으로 인해 빈 값이 검사되...

busybox: busybox: httpd misidentifies yescrypt password hashes as plaintext, inverting authentication

BusyBox httpd treats yescrypt $y$ password hashes as plaintext during Basic Authentication, inverting the authentication check...

Linux Distros Unpatched Vulnerability : CVE-2026-88837

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - BusyBox httpd treats yescrypt $y$ password hashes as plaintext during Basic Authentication, inverting the authentication check. CVE-2026-88837 Note that Nessus...

SUSE CVE-2026-88837

BusyBox httpd treats yescrypt $y$ password hashes as plaintext during Basic Authentication, inverting the authentication check...

DEBIAN-CVE-2026-88837

BusyBox httpd treats yescrypt $y$ password hashes as plaintext during Basic Authentication, inverting the authentication check...

CVE-2026-88837

BusyBox httpd treats yescrypt $y$ password hashes as plaintext during Basic Authentication, inverting the authentication check...

CVE-2026-88837

BusyBox httpd treats yescrypt $y$ password hashes as plaintext during Basic Authentication, inverting the authentication check...

UBUNTU-CVE-2026-88837

BusyBox httpd treats yescrypt $y$ password hashes as plaintext during Basic Authentication, inverting the authentication check...

CVE-2026-88837 Busybox: busybox: httpd misidentifies yescrypt password hashes as plaintext, inverting authentication

BusyBox httpd treats yescrypt $y$ password hashes as plaintext during Basic Authentication, inverting the authentication check...

CVE-2026-88837

The BusyBox httpd component is vulnerable to an authentication bypass because it incorrectly treats yescrypt ($y$) password hashes as plaintext during Basic Authentication . This flaw inverts the authentication check, potentially allowing unauthorized access. To mitigate this risk, users are advi...

CVE-2026-88837 Busybox: busybox: httpd misidentifies yescrypt password hashes as plaintext, inverting authentication

BusyBox httpd treats yescrypt $y$ password hashes as plaintext during Basic Authentication, inverting the authentication check...

CVE-2026-88837

BusyBox httpd treats yescrypt $y$ password hashes as plaintext during Basic Authentication, inverting the authentication check...

EUVD-2026-85511

BusyBox httpd treats yescrypt $y$ password hashes as plaintext during Basic Authentication, inverting the authentication check...

CVE-2026-88837

BusyBox httpd treats yescrypt $y$ password hashes as plaintext during Basic Authentication, inverting the authentication check. Mitigation Do not use BusyBox httpd for password-protected resources. If it must be used, configure authentication with SHA-512 $6$ hashes, which are correctly detected...

CVE-2026-88837: Authentication Bypass by Primary Weakness

BusyBox httpd treats yescrypt $y$ password hashes as plaintext during Basic Authentication, inverting the authentication check...

PT-2026-97428

BusyBox httpd treats yescrypt $y$ password hashes as plaintext during Basic Authentication, inverting the authentication check...

PT-2026-85524

Holloway Chew, Kean Ho's Actualizer v1.2.0 and earlier contains a fail-open password validation vulnerability in the Alpha user and root user password loops of Shell/debian-minbase-install.sh. The installer invokes mkpasswd to generate yescrypt password hashes but does not check the command's...

CVE-2026-15041

A flaw was found in 389 Directory Server. The PBKDF2-SHA256 password verification function uses standard memcmp for comparing password hashes instead of a constant-time comparison function. A remote attacker could potentially use timing measurements of LDAP bind attempts to infer partial hash...

CVE-2025-13532

Insecure defaults in the Server Agent component of Fortra's Core Privileged Access Manager BoKS can result in the selection of weak password hash algorithms. This issue affects BoKS Server Agent 9.0 instances that support yescrypt and are running in a BoKS 8.1 domain...

EUVD-2025-203842

Insecure defaults in the Server Agent component of Fortra's Core Privileged Access Manager BoKS can result in the selection of weak password hash algorithms. This issue affects BoKS Server Agent 9.0 instances that support yescrypt and are running in a BoKS 8.1 domain...