Redeight CMS version 1.0 uses the MD5 algorithm without a salt to store user passwords. Because MD5 is cryptographically broken and lacks salting, attackers who obtain the password hashes can trivially reverse them using rainbow tables, leading to the exposure of plaintext credentials. This weakness is identified as CWE-261. No official patch or remediation is currently documented for this vulnerability.

An attacker who gains access to the password hashes can easily recover the original plaintext passwords due to the use of unsalted MD5 hashes. This compromises user credentials, potentially allowing unauthorized access to user accounts. The vulnerability does not require user interaction and has low attack complexity but requires local access to the hashes.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, it is recommended to avoid using Redeight CMS version 1.0 in sensitive environments or implement compensating controls such as restricting access to password hash storage. Consider upgrading to a version that uses a secure password hashing algorithm with salting once available.