CVE-2026-110104: Use of Password Hash With Insufficient Computational Effort in xxyopen novel

CVE-2026-110104 identifies a cryptographic weakness in xxyopen novel through version 3.5.0 where the UserServiceImpl.register() method stores user passwords as unsalted MD5 hashes in the user_info.password database column. MD5 is a fast, outdated hash function vulnerable to precomputed hash attacks and GPU brute forcing. Attackers obtaining these hashes can recover plaintext passwords and potentially reuse credentials elsewhere. The CVSS 4.0 base score is 8.2, indicating high severity with network attack vector, low attack complexity, and partial attack impact on confidentiality.

An attacker who obtains the password hash database can efficiently crack user passwords due to the use of unsalted MD5 hashes. This compromises user credential confidentiality and may lead to unauthorized access if users reuse passwords. The vulnerability does not require user interaction and can be exploited remotely if the hashes are exposed.

No official patch or remediation details are provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, consider mitigating risk by restricting database access, monitoring for leaks, and encouraging users to change passwords. Implementing stronger password hashing algorithms (e.g., bcrypt, Argon2) with salting is recommended once a patch is released.