Weak Password Hash Vulnerability in iWebShop-5 by aircheng-org

CVE-2026-86670

What is CVE-2026-86670?

A significant security vulnerability exists in the aircheng-org iWebShop-5 platform, specifically in the Authentication Storage feature located in the controllers/admin.php file. This flaw allows an attacker to manipulate the argument for passwords, potentially leading to the use of weak password hashing algorithms. Such weaknesses undermine the computational effort required to secure password hashes, thus exposing user accounts to unauthorized access. Although the complexity involved in exploiting this issue is considered high, the potential for a successful attack remains a concern, especially since the exploit has been published and might soon be leveraged by malicious actors.

References