CVE-2026-6217: CWE-759 Use of a One-Way hash without a salt in Pik Online Software Solutions Inc. Pik Online Portal

This vulnerability (CWE-759) arises from the use of a one-way hash without incorporating a salt in Pik Online Portal software versions through 3.5.1. The absence of a salt weakens the cryptographic strength of the hash, making it susceptible to cryptanalysis, potentially allowing attackers to reverse or predict hashed values under certain conditions. The CVSS 3.1 vector indicates network attack vector, low attack complexity, requires low privileges and user interaction, with high confidentiality impact, low integrity impact, and no availability impact. No vendor advisory or patch information is currently available.

The primary impact is a high confidentiality risk due to the possibility of cryptanalysis on unsalted hashes, which could lead to exposure of sensitive information. Integrity impact is low, and availability is not affected. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider mitigating the risk by implementing additional protective measures around hashed data, such as applying salting manually if possible or restricting access to hashed data. Monitor vendor communications for updates.