# CVE-2026-88837: BusyBox httpd authentication bypass with yescrypt hashes

Source: https://junglewise.ai/threats/cve-2026-88837-busybox-httpd-treats-yescrypt-y-password-hashes-as-plaintext  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-23. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-88837 · Severity: medium · CVSS 6.5 · Published 2026-09-23

BusyBox httpd is a lightweight web server used in embedded devices and container images. A flaw in its Basic Authentication implementation causes it to treat yescrypt password hashes as plaintext, inverting the authentication logic and allowing unauthorized access to protected resources. An attacker can bypass password authentication without knowing the actual credentials.

Vendors: [Busybox](https://junglewise.ai/threats/vendors/busybox).

## Quick answers

**Is CVE-2026-88837 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-88837 being exploited in the wild.

**How severe is CVE-2026-88837?** Medium severity, with a CVSS score of 6.5, published 23 September 2026.

**Which products and versions are affected?** Busybox Httpd prior to 1.37.0-9.1.hum1.

**Is there a fix for CVE-2026-88837?** A patch was published on 2026-09-25: Fixed in BusyBox 1.37.0-9.1.hum1 via RHSA-2026:72111 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-88837 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-88837?** Check whether you run Busybox Httpd at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

BusyBox httpd incorrectly processes yescrypt ($y$ prefix) password hashes during Basic Authentication verification, treating the hash value as the plaintext password instead of comparing the submitted password against the hash. This inversion of the authentication check allows any request with the hash itself as the password to be accepted. The vulnerability affects the httpd component and requires network access with no pre-authentication needed.

## Affected products

- BusyBox httpd prior to 1.37.0-9.1.hum1

## Timeline

- 2026-09-23: disclosed
- 2026-09-25: patched: Fixed in BusyBox 1.37.0-9.1.hum1 via RHSA-2026:72111

## References

- [https://catalog.redhat.com/software/containers/](https://catalog.redhat.com/software/containers/)
- [https://access.redhat.com/errata/RHSA-2026:72111](https://access.redhat.com/errata/RHSA-2026:72111)

## Related threats

- [BusyBox httpd IP deny rules CIDR prefix parsing bypass](https://junglewise.ai/threats/cve-2026-88831-busybox-httpd-ip-deny-rules-with-invalid-cidr-prefix-lengths-fail)