MaxKB, an open-source AI assistant for enterprise, used unsalted MD5 hashes for storing user passwords in versions before 2.9.1. MD5 is a cryptographically weak hash function vulnerable to precomputed rainbow table attacks and fast brute force attacks with GPU acceleration. This weakness allows attackers with local access to the password hashes to recover plaintext passwords easily. The vulnerability is identified as CWE-328 (Use of Weak Hash). The issue is resolved in MaxKB version 2.9.1, which presumably replaces MD5 with a stronger password hashing mechanism.

Passwords stored with unsalted MD5 hashes can be quickly cracked if an attacker obtains the hash data, compromising user credentials. This can lead to unauthorized access to user accounts. However, exploitation requires local access to the hashed password data, as indicated by the CVSS vector (AV:L). There is no indication of remote exploitation or privilege escalation. No known exploits in the wild have been reported.

Upgrade MaxKB to version 2.9.1 or later, where the password storage mechanism has been fixed to use a stronger hashing algorithm. Since the vendor advisory confirms the fix in 2.9.1, applying this update fully mitigates the vulnerability. No other mitigation steps are indicated.