CVE-2026-80211

Name of the Vulnerable Software and Affected Versions FrontAccounting versions prior to 2.4.21

Description User passwords are stored and verified as unsalted MD5 digests. The application fails to use per-password salts or adaptive hashing functions, meaning identical passwords result in identical digests. This allows an attacker with access to the user table to recover plaintext passwords using high-rate GPU cracking or precomputed lookup tables. The issue affects the add user() and update user password() functions called by the 'admin/users.php' endpoint, the 'admin/change current user password.php' endpoint, the forgotten-password path in 'includes/current user.inc', and the get user auth() function used during authentication, all of which process the password variable using the md5() function.

Recommendations Update FrontAccounting to version 2.4.21 or later.