# CVE-2026-25861: QloApps weak password hashing in Tools.php

Source: https://junglewise.ai/threats/cve-2026-25861-qloapps-weak-password-hashing-in-tools-php  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-02. Updated: 2026-06-02  
License: CC BY 4.0 with a link back

CVE-2026-25861 · Severity: medium · CVSS 5.9 · Published 2026-06-02

QloApps, an open-source hotel booking and reservation system, uses an outdated and weak method for securing user passwords. This flaw allows attackers who obtain the database to easily crack user passwords through automated guessing, potentially leading to unauthorized access to customer accounts and sensitive personal information. The risk is particularly high for accounts converted from guest status, which are assigned short, predictable passwords.

Technologies: [QloApps](https://junglewise.ai/threats/technologies/qloapps). Vendors: [QloApps](https://junglewise.ai/threats/vendors/qloapps).

## Quick answers

**Is CVE-2026-25861 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-25861 being exploited in the wild.

**How severe is CVE-2026-25861?** Medium severity, with a CVSS score of 5.9, published 2 June 2026.

**Which products and versions are affected?** QloApps through 1.7.0.

**Is there a fix for CVE-2026-25861?** A patch was published on 2026-05-19: Fix merged into develop branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-25861 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-25861?** Check whether you run QloApps at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

QloApps through version 1.7.0 utilizes the MD5 hashing algorithm within the Tools::encrypt() function in classes/Tools.php to secure user passwords. The implementation concatenates a static cookie key with the password before hashing, which does not provide sufficient protection against modern offline brute-force attacks. Furthermore, the classes/Customer.php component auto-generates weak 8-character passwords during guest-to-customer account conversions, significantly reducing the entropy required for successful credential recovery. An attacker with access to the hashed credentials can trivially recover plaintext passwords. The issue was addressed in commit 64e9722 by migrating the hashing mechanism to bcrypt.

## Affected products

- QloApps QloApps through 1.7.0

## Timeline

- 2026-03-13: other: Pull request initiated
- 2026-05-19: patched: Fix merged into develop branch
- 2026-06-02: disclosed: Vulnerability details published

## References

- [https://github.com/Qloapps/QloApps/commit/64e9722e7e6a8fda77dd53964d988fb6b5c3d174](https://github.com/Qloapps/QloApps/commit/64e9722e7e6a8fda77dd53964d988fb6b5c3d174)
- [https://github.com/Qloapps/QloApps/pull/1689](https://github.com/Qloapps/QloApps/pull/1689)
- [https://www.vulncheck.com/advisories/qloapps-weak-password-hashing-via-md5-in-tools-php](https://www.vulncheck.com/advisories/qloapps-weak-password-hashing-via-md5-in-tools-php)

## Related threats

- [QloApps missing authorization in qlohotelreview AddReview](https://junglewise.ai/threats/cve-2026-116746-qloapps-1-6-0-through-1-7-0-contains-a-missing-authorization)
- [QloApps information disclosure in OrderConfirmationController](https://junglewise.ai/threats/cve-2026-116745-qloapps-through-1-7-0-contains-an-information-disclosure)
- [QloApps insecure direct object reference in refund handling](https://junglewise.ai/threats/cve-2026-115326-qloapps-through-1-7-0-contains-an-insecure-direct-object)
- [QloApps improper access control in AdminSlipController](https://junglewise.ai/threats/cve-2026-110229-qloapps-through-1-7-0-contains-an-improper-access-control)
- [QloApps broken access control in room type creation](https://junglewise.ai/threats/cve-2026-110226-qloapps-through-1-7-0-contains-a-broken-access-control)