BusyBox httpd mishandles yescrypt ($y$) password hashes by treating them as plaintext during Basic Authentication, effectively inverting the authentication logic and allowing authentication bypass. This vulnerability affects configurations where BusyBox httpd is used with inline yescrypt password hashes. Fedora 44's default use of yescrypt means that system administrators configuring BusyBox httpd with inline hashes may produce vulnerable setups. The recommended mitigation is to avoid using BusyBox httpd for password-protected resources or to configure authentication with SHA-512 ($6$) hashes, which are correctly recognized. Upstream BusyBox should update hash detection logic to properly identify the $y$ prefix.

The vulnerability allows an attacker to bypass authentication due to incorrect handling of yescrypt password hashes, potentially granting unauthorized access to password-protected resources served by BusyBox httpd. The CVSS 3.1 base score is 6.5 (medium severity) with high confidentiality impact, low integrity impact, and no availability impact. There are no known exploits in the wild. The impact is limited by the fact that BusyBox httpd is not used as a web server in standard Fedora deployments.

Do not use BusyBox httpd for password-protected resources. If its use is necessary, configure authentication using SHA-512 ($6$) password hashes instead of yescrypt ($y$) hashes. Monitor Red Hat advisories for updates, as upstream BusyBox is expected to update hash detection logic to correctly handle yescrypt hashes. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.