# CVE-2026-80211: FrontAccounting weak password hashing with unsalted MD5

Source: https://junglewise.ai/threats/cve-2026-80211-frontaccounting-weak-password-hashing-with-unsalted-md5  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-27. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-80211 · Severity: medium · CVSS 5.9 · Published 2026-08-27

FrontAccounting is an open-source enterprise resource planning (ERP) system used to manage business operations and accounting. The software stores user passwords as unsalted MD5 hashes, a cryptographically weak practice that allows attackers who gain access to the user database to recover plaintext passwords rapidly using precomputed lookup tables or GPU-based cracking. This could lead to unauthorized system access and potential compromise of sensitive financial and operational data.

Technologies: [FrontAccounting](https://junglewise.ai/threats/technologies/frontaccounting). Vendors: [FrontAccounting](https://junglewise.ai/threats/vendors/frontaccounting).

## Quick answers

**Is CVE-2026-80211 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-80211 being exploited in the wild.

**How severe is CVE-2026-80211?** Medium severity, with a CVSS score of 5.9, published 27 August 2026.

**Which products and versions are affected?** FrontAccounting through 2.4.20.

**Is there a fix for CVE-2026-80211?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-80211 attacked?** It is attacked with local access, in a web application.

**Am I affected by CVE-2026-80211?** Check whether you run FrontAccounting at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

FrontAccounting through version 2.4.20 uses unsalted MD5 hashing for password storage and authentication across multiple code paths: admin/users.php, admin/change_current_user_password.php, and the forgotten-password recovery in includes/current_user.inc all pass md5($_POST['password']) directly to password functions. The authentication process calls get_user_auth($loginname, md5($password)), comparing MD5 digests without any per-password salt or adaptive hashing algorithm. Identical passwords produce identical digests, enabling rapid plaintext recovery via rainbow tables or high-rate GPU cracking if the user table is obtained through SQL injection, database breach, or file system access. No patch status is publicly documented; mitigation requires migrating to bcrypt, scrypt, or Argon2-based hashing with proper salting.

## Affected products

- FrontAccounting FrontAccounting through 2.4.20

## Timeline

- 2026-08-27: disclosed

## References

- [https://github.com/FrontAccountingERP/FA](https://github.com/FrontAccountingERP/FA)
- [https://github.com/FrontAccountingERP/FA/blob/9464a3ffef03c139d9396e697bce9a0a9f131a72/includes/current_user.inc](https://github.com/FrontAccountingERP/FA/blob/9464a3ffef03c139d9396e697bce9a0a9f131a72/includes/current_user.inc)

## Related threats

- [FrontAccounting CSRF in financial transaction handlers](https://junglewise.ai/threats/cve-2026-80210-frontaccounting-csrf-in-financial-transaction-handlers)
- [FrontAccounting SQL injection in get_gl_transactions](https://junglewise.ai/threats/cve-2026-40524-frontaccounting-sql-injection-in-get-gl-transactions)
- [FrontAccounting SQL injection in Audit Trail report handler](https://junglewise.ai/threats/cve-2026-40523-frontaccounting-sql-injection-in-audit-trail-report-handler)
- [FrontAccounting SQL injection in Bank Statement report](https://junglewise.ai/threats/cve-2026-40522-frontaccounting-sql-injection-in-bank-statement-report)
- [FrontAccounting path traversal and RCE in attachment upload handler](https://junglewise.ai/threats/cve-2026-40521-frontaccounting-path-traversal-and-rce-in-attachment-upload)