CVE-2026-86670: Password Hash With Insufficient Computational Effort in aircheng-org iWebShop-5

This vulnerability affects aircheng-org iWebShop-5 versions 5.0 through 5.15. It arises from a weakness in the password hashing mechanism used in the Authentication Storage component (controllers/admin.php), where the computational effort for hashing passwords is insufficient. This could potentially allow an attacker to manipulate the Password argument remotely to exploit the weakness. The attack complexity is high, and no privileges or user interaction are required. Although an exploit has been published, the exploitability is considered difficult. No official remediation or patch has been released by the vendor as of the publication date.

The insufficient computational effort in password hashing could reduce the effectiveness of password protection, potentially making it easier for attackers to perform offline password cracking if they obtain hashed passwords. However, the vulnerability does not directly allow privilege escalation, denial of service, or data integrity compromise. The attack requires remote access and is difficult to execute, limiting the immediate impact. No active exploitation in the wild has been reported.

No official fix or patch is currently available from the vendor. Since the vendor has not responded or provided remediation guidance, users should consider implementing additional protective measures such as enforcing strong password policies and monitoring for suspicious activity related to authentication. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.