The vulnerability in WeGIA (CVE-2026-45027) arises from the use of PHP's hash() function with SHA-256 without a salt to hash user passwords during login and password change processes. SHA-256 is a fast, general-purpose hash function not designed for password storage, and the absence of a salt means that identical passwords yield identical hashes. This weakness enables attackers to use precomputed rainbow tables to reverse hashes and potentially recover user passwords. The issue affects all versions prior to 3.7.3 and is fixed in version 3.7.3.

The vulnerability exposes password hashes to rainbow table attacks, potentially allowing attackers to recover user passwords if they obtain the hash database. This compromises user credential confidentiality but does not affect integrity or availability. There are no known exploits in the wild at this time.

Upgrade WeGIA to version 3.7.3 or later, where the password hashing mechanism has been fixed to include salting or a more secure password hashing approach. Since no official patch link or advisory is provided, verify the upgrade availability with the vendor. Patch status is not yet confirmed beyond the stated fixed version; check the vendor advisory for current remediation guidance.