# CVE-2026-92921: admin3 weak password hashing with single-round MD5

Source: https://junglewise.ai/threats/cve-2026-92921-admin3-weak-password-hashing-with-single-round-md5  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-17. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-92921 · Severity: medium · CVSS 4.9 · Published 2026-09-17

admin3 is a lightweight backend administration framework that uses a weak password hashing scheme (single-round MD5 with username as salt) to store user account credentials. An attacker who gains access to the application database can easily recover plaintext passwords through offline dictionary or brute-force attacks due to MD5's low computational cost and lack of key derivation functions.

## Quick answers

**Is CVE-2026-92921 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-92921 being exploited in the wild.

**How severe is CVE-2026-92921?** Medium severity, with a CVSS score of 4.9, published 17 September 2026.

**Which products and versions are affected?** LinYuanyi admin3 through 3.0.0.

**Is there a fix for CVE-2026-92921?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-92921 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-92921?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a cryptographic weakness in password storage: admin3 uses MD5 hashing with only the username concatenated as salt (without separator) and no key derivation function or work factor. The hashing implementation also exhibits a non-canonical encoding defect (leading zeros dropped by BigInteger.toString(16)), causing roughly 6.25% of hashes to be incompatible with standard MD5 representations. An attacker with database access can perform offline password recovery attacks with negligible computational effort. The vulnerability affects versions through 3.0.0; patched versions use proper password hashing with appropriate salt and key derivation.

## Affected products

- LinYuanyi admin3 through 3.0.0

## Timeline

- 2026-09-17: disclosed: CVE-2026-92921 published on NVD

## References

- [https://github.com/LinYuanyi1/cve-request-poc/blob/master/admin3/C08_md5_credential_hashing.py](https://github.com/LinYuanyi1/cve-request-poc/blob/master/admin3/C08_md5_credential_hashing.py)
- [https://github.com/cjbi/admin3](https://github.com/cjbi/admin3)