PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-45027 LabRedesCefetRJ CVE debrief

WeGIA versions prior to 3.7.3 use unsalted SHA-256 for password hashing in authentication and password-change flows. SHA-256 is a fast, general-purpose hash unsuitable for password storage; without a salt, identical passwords yield identical digests, enabling efficient rainbow-table attacks against the credential database. The vulnerability is fixed in version 3.7.3.

Vendor
LabRedesCefetRJ
Product
WeGIA
CVSS
MEDIUM 5.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-05-27
Original CVE updated
2026-05-27
Advisory published
2026-05-27
Advisory updated
2026-05-27

Who should care

Organizations operating WeGIA for charitable institution management; security teams responsible for PHP application hardening; compliance auditors evaluating password-storage controls against OWASP or NIST guidelines.

Technical summary

The WeGIA web application hashes passwords using PHP's hash() function with SHA-256 and no salt during login (html/login.php) and password changes (controle/FuncionarioControle.php). SHA-256's speed and lack of memory-hard properties make it vulnerable to brute-force and precomputed hash attacks. The absence of a salt allows attackers to use a single rainbow table to recover passwords that share the same hash across the entire user base. Version 3.7.3 remediates this weakness.

Defensive priority

medium

Recommended defensive actions

  • Upgrade WeGIA to version 3.7.3 or later to obtain the corrected password-hashing implementation.
  • Audit stored password hashes for evidence of compromise; force password resets for affected accounts if unauthorized access is suspected.
  • Verify that any custom authentication modules do not replicate the unsalted SHA-256 pattern.
  • Review application logs for anomalous authentication patterns that may indicate credential-based attacks.

Evidence notes

Official GitHub Security Advisory GHSA-hcgv-vmq6-j6qg confirms the hashing implementation in html/login.php and controle/FuncionarioControle.php, the absence of salt, and the fix in 3.7.3.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-45027 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-45027

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-45027 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-45027

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.