Skip to content
OpenAdvisories

Weakness (CWE)

CWE-836: Use of Password Hash Instead of Password for Authentication

Base Incomplete

The product includes a client that computes a hash of a password and sends the hash to another component, which compares the supplied hash to the hash obtained from a data store of password hashes.

Source: MITRE CWE-836

All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • High 7.4
    CVE-2026-63158

    Omnispace Agora Project < 26.10.0 Pass-the-Hash Authentication Bypass via Cookies

    Omnispace Agora Project before 26.10.0 contains an authentication bypass vulnerability that allows attackers possessing a user's stored bcrypt password hash to authenticate as that user without knowing the actual password, caused by the legacy AGORAP_LOG/AGOR…

    Omnispace Agora Project
  • High 8.1
    CVE-2026-9222

    Setracker2 Children's Smartwatch Ecosystem Use of password hash instead of password for authentication

    Setracker2 Android Companion App com.tgelec.setracker versions 3.1.5 and prior only require the password hash when authenticating with backend services from the client. This could allow an attacker, who knows the hash, to authenticate and gain full access.

    Shenzhen i365-Tech Setracker2 Parental Control App (Android) package com.tgelec.setracker Android
  • High 7.5
    CVE-2019-25552

    CEWE PHOTO SHOW 6.4.3 Denial of Service via Password Field

    CEWE PHOTO SHOW 6.4.3 contains a denial of service vulnerability that allows attackers to crash the application by submitting an excessively long buffer to the password field. Attackers can paste a large string of repeated characters into the password input d…

    Cewe-Photoworld CEWE PHOTO SHOW
  • High 8.0
    CVE-2025-62618

    ELOG file upload stored XSS

    ELOG allows an authenticated user to upload arbitrary HTML files. The HTML content is executed in the context of other users when they open the file. Because ELOG includes usernames and password hashes in certain HTTP requests, an attacker can obtain the targ…

    ELOG ELOG
  • High 8.8
    CVE-2023-23614

    Improper session handling of "Remember me for 7 days" functionality

    Pi-hole®'s Web interface (based off of AdminLTE) provides a central location to manage your Pi-hole. Versions 4.0 and above, prior to 5.18.3 are vulnerable to Insufficient Session Expiration. Improper use of admin WEBPASSWORD hash as "Remember me for 7 days" …

    pi-hole AdminLTE
  • High 7.2
    CVE-2022-32282

    An improper password check exists in the login functionality of WWBN AVideo 11.6 and dev master commit 3f7c0364. An att…

    WWBN AVideo