Weak Password Hashing Flaw in Xxyopen Novel Product by Xxyopen

CVE-2026-110104

What is CVE-2026-110104?

The Xxyopen Novel product, specifically version 3.5.0, has a vulnerability that stems from improperly secured password storage. User passwords are hashed using unsalted MD5 algorithms, making them susceptible to recovery by attackers. If these hashed passwords are exposed through database leaks or backup vulnerabilities, attackers can exploit precomputed tables or perform brute-force attacks using GPUs, leading to potential credential reuse. It is crucial for users to upgrade to a more secure version to prevent unauthorized access and safeguard sensitive user information.

References