CVE-2026-112029: Password Hash With Insufficient Computational Effort in diem-project diem

This vulnerability affects diem-project diem up to version 5.1.3 in the file lib/model/doctrine/PluginDmUser.class.php within the SHA1 Handler component. It allows an attacker with local access to manipulate the salt or password arguments, resulting in password hashes that require insufficient computational effort to compute. The attack complexity is high, and no privileges beyond local access are required. The vulnerability has been publicly disclosed, but the vendor has not yet issued a fix or response.

The vulnerability could allow an attacker with local access to reduce the computational effort needed to compute password hashes, potentially making password cracking easier. However, the attack requires a high level of complexity and local access, limiting the practical impact. There is no indication of remote exploitation or privilege escalation. No known exploits are currently in the wild.

No official fix or patch is currently available, and the vendor has not responded to the issue report. Users should monitor the vendor advisory for updates. Until a patch is released, restricting local access to trusted users and systems is recommended to reduce risk.