logo

Database

Insecure encryption algorithm In sulu/sulu

Description

Sulu: Weak Cryptographical usage for API Key generation and Reset Tokens

Impact

The password reset tokenand API key generation uses a weak cryptographical hash algorithm.

Patches

Fixed in 2.6.23 and 3.0.6 version.

Workarounds

Patch the related User.php and ResettingController.php file in the SecurityBundle.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2026-457012. NVD-2026-457013. OSV-2026-457014. GHSA-7fv8-6pp7-6h855. GCVE-2026-45701

References

1. https://github.com/sulu/sulu/security/advisories/GHSA-7fv8-6pp7-6h852. https://github.com/sulu/sulu/releases/tag/2.6.233. https://github.com/sulu/sulu/releases/tag/3.0.6

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.