Weak Password Hashing in SQLBot by DataEase Affects Local Account Security

CVE-2026-129127

What is CVE-2026-129127?

A vulnerability in SQLBot through version 1.10.3 allows the storage of local account passwords as unsalted MD5 hashes, resulting in weak password management. This weakness can be exploited by attackers who gain access to the user table, enabling them to leverage precomputed tables or GPU cracking methods to retrieve passwords, including those of administrators. The repeated use of identical passwords leads to identical hashes, further exacerbating the risk associated with this vulnerability.

References