CVE-2026-107829: Use of Password Hash With Insufficient Computational Effort in banq jivejdon

CVE-2026-107829 identifies a vulnerability in banq's Jivejdon product through version 5.0, where account passwords are stored as unsalted MD5 hashes via the ToolsUtil.hash() function in AccountDaoSql. The use of unsalted MD5 is considered weak due to its susceptibility to precomputed hash attacks and GPU-accelerated cracking. An attacker with access to the user table, either through direct database access or SQL injection, can exploit this weakness to recover plaintext passwords.

Attackers who obtain the user table can efficiently crack stored passwords, potentially leading to unauthorized account access. This compromises user credentials and may facilitate further attacks or data breaches. The vulnerability does not require user interaction and can be exploited remotely if SQL injection is present.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider additional protective measures such as enforcing strong password policies, monitoring for SQL injection vulnerabilities, and restricting database access. Migration to a stronger password hashing algorithm with salting (e.g., bcrypt, Argon2) is recommended once a patch is provided.