xxyopen novel: Weak password hashing with unsalted MD5
Summary
xxyopen novel through version 3.5.0 stores user passwords as unsalted MD5 digests during registration (CWE-916). An attacker who obtains the user table, for example through a database leak or an exposed backup, can crack these hashes with precomputed tables or GPU brute force and recover plaintext passwords. The recovered credentials can then be reused on other services.
Affected
- xxyopen novel 0 to 3.5.0 (according to the CNA VulnCheck; default: unaffected)
Fixed in
- Unknown version number.
- Fix commit fa82ce7 (merge of pull request #53) switches new passwords to BCrypt and upgrades legacy MD5 hashes to BCrypt at login. Check the repository for a release that contains this commit.
Workaround
- Restrict and monitor access to the database and backups, since the attack depends on them.
- Migrate stored hashes to BCrypt, for example with the upgrade-on-login approach from pull request #53.
- Do not use custom password hashing; use a current, maintained library.
Exploitation
- CISA SSVC lists exploitation as 'poc' (proof of concept); Automatable: no.
- No confirmed in-the-wild exploitation known.
- Exploitation requires a database leak or backup exposure.
Our recommendation
- If novel is deployed publicly, check whether it runs version 3.5.0 or earlier, or a version without commit fa82ce7.
- Update to a version that contains the BCrypt fix, or apply the change manually.
- Force password resets for accounts created before the fix and ask users not to reuse passwords.
- Protect database backups and monitor access to them.
- If the project is only a demo, remove it or disable public registration.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- OSV record CVE-2026-110104 osv.dev
- VulnCheck advisory: novel through 3.5.0 Unsalted MD5 Password Storage www.vulncheck.com
- Affected code: UserServiceImpl.java at v3.5.0 github.com
- Fix commit fa82ce7 (merge of pull request #53) github.com
- Pull request #53: BCrypt password hashing github.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 16:31.
Original description (NVD)
Xxyopen novel through 3.5.0 contains a weak password hashing vulnerability that allows attackers to recover plaintext passwords because UserServiceImpl.register() stores unsalted MD5 digests in user_info.password. Attackers who obtain the password column through a database leak or backup exposure can crack hashes with precomputed tables or GPU brute force and reuse credentials.
NVD references (5)
- https://github.com/201206030/novel/blob/v3.5.0/src/main/java/io/github/xxyopen/novel/service/impl/UserService…
- https://github.com/201206030/novel/commit/fa82ce7e426a5b29db469b8f13d2e29fc1260871
- https://github.com/201206030/novel/pull/53
- https://www.vulncheck.com/advisories/novel-through-3.5.0-unsalted-md5-password-storage
- https://github.com/201206030/novel/pull/53
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.