Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:NSummary
CVE-2026-45027 is a medium-severity Use of a One-Way Hash without a Salt (CWE-759) vulnerability. Its CVSS base score is 5.9 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Brute Force (T1110); ranked at the 3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to IA-5 (Authenticator Management) and SA-11 (Developer Testing and Evaluation) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-32565
Vulnerability Data
WeGIA is a web manager for charitable institutions. In versions prior to 3.7.3, when a user logs in, html/login.php hashes the submitted password using PHP's hash() function with the SHA-256 algorithm and no salt before comparing it to the stored…
more
value. The password change flow in controle/FuncionarioControle.php follows the same pattern. SHA-256 is a general-purpose cryptographic hash built for speed, not password storage. Without a salt, identical passwords produce identical digests, making the entire hash database vulnerable to a single precomputed rainbow table lookup. This vulnerability is fixed in 3.7.3.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V11.4.2
Mitigating Controls (NIST 800-53 r5) AI
Cryptographic protection requirements specify approved algorithms and usage that encompass salted one-way hashes for passwords.
Authenticator management requires secure credential storage practices that include salted hashes.
Developer testing and evaluation can identify missing salt values through code review or analysis.
Development standards and tools can mandate salted hashing as part of secure implementation requirements.
Protection of information at rest requires cryptographic safeguards on stored password hashes, reducing exposure to offline cracking.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices mandate correct password storage with salts, eliminating this exact weakness.
Proper cryptographic hashing for data-at-rest protection directly requires salted hashes for passwords.
Authentication policies may reference password handling but do not address storage or computational cost of hashes.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Use of cryptography requires appropriate cryptographic controls including salting for password hashing.
Security testing can detect unsalted hashes but does not prevent their introduction.
Requires secure handling of authentication information, which includes choosing strong password hashing schemes.
Secure SDLC processes can include password-handling rules but do not guarantee salted hashes.
Application security requirements can mandate salted hashing but do not prescribe the technical detail.
Secure coding standards explicitly forbid unsalted password hashes and require salting.