Rule Explorer

An encryption key is derived from a secret with a single fast, unsalted hash ($HASH) and the digest is fed straight into a symmetric cipher to encrypt data. Ciphertext produced this way can be brute-forced fully offline at GPU speed (no per-ciphertext KDF work and no salt, so precomputed tables and cross-backup key reuse apply), which exposes every password-

PythonCVE-2026-116071CWE-327CWE-916

An authentication credential is derived from an external identity identifier (e.g. md5($data['id'])) and used to verify or provision a local account. The identifier is often public or guessable, so anyone can reproduce the credential and take over the account through the ordinary password login form. Provision federated accounts with a CSPRNG password, verif

PHPCVE-2026-109321CWE-288CWE-328CWE-352

Unrecognized flat KDF configuration keys (such as 'argon2_time_cost' or 'sha512_iterations') are assigned to hash_config. In crypt_core, these flat keys are ignored while defeating default template fallbacks, collapsing password key derivation to single unstretched SHA-256 (CWE-916).

PythonCVE-2026-81704CWE-916

A key derivation function accepts an iteration parameter but uses wc_HKDF instead of a password-based key derivation function like wc_PBKDF2. HKDF does not support computational work factor scaling, severely weakening offline password security.

CCVE-2026-53762CWE-327CWE-916