Common Weakness Enumeration
CWE-836 Use of Password Hash Instead of Password for Authentication
Description
The product records password hashes in a data store, receives a hash of a password from a client, and compares the supplied hash to the hash obtained from the data store.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-836 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-r3cw-c95m-wfh9 | CVE-2026-46488 | CRITICAL |
motionEye: Authentication possible via password hash |
2026-06-22 | |
| GHSA-v479-vf79-mg83 | CVE-2026-40103 | MODERATE |
Vikunja: Scoped API tokens with projects.background permission can delete project backgrounds |
2026-04-24 |