Executive brief
BusyBox httpd treats yescrypt ($y$) password hashes as plaintext during Basic Authentication, inverting the authentication check.
Junglewise Threat Intelligence
CVE-2026-88837: BusyBox httpd treats yescrypt ($y$) password hashes as plaintext during Basic Authentication, inverting the authentication check.
CVE-2026-88837 · Severity: medium · CVSS 6.5 · Published 2026-09-23