CVE-2026-57310 describes a weakness in Windu CMS 4.1 where user passwords are hashed using MD5 and SHA1 algorithms combined with a static salt. These hashing methods do not provide sufficient computational effort to protect password hashes against cracking attempts. As a result, an attacker who gains access to the password hashes can decode user credentials. Attempts to contact the vendor for remediation have been unsuccessful, and no official fix or mitigation has been published.

The vulnerability allows attackers who obtain password hashes from Windu CMS 4.1 to decode user passwords due to the use of weak hashing algorithms and static salt. This compromises user credential confidentiality and could lead to unauthorized access if hashes are leaked or stolen.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or remediation level is provided and vendor contact attempts were unsuccessful, users should consider additional protective measures such as restricting access to password hash storage and monitoring for unauthorized access until a fix is available.