Authentication Bypass in BusyBox httpd due to Plaintext Treatment of yescrypt Password Hashes
CVE-2026-88837

6.5MEDIUM

Key Information:

Vendor

Red Hat
Status
Red Hat Hardened Images
Vendor
CVE Published:
23 September 2026

What is CVE-2026-88837?

The BusyBox httpd server has a security flaw where it incorrectly processes yescrypt password hashes during Basic Authentication. This flaw treats these secure hashes as plaintext, allowing an attacker to bypass authentication checks. As a result, unauthorized access to the system could be achieved, compromising the integrity of applications using this server. It is crucial for users to assess their implementation and consider applying necessary patches or configurations to mitigate the risk associated with this vulnerability.

References

https://access.redhat.com/security/cve/CVE-2026-88837
vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2531351
issue-trackingx_refsource_REDHAT

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
Low
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.