CVE-2024-56516

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-56516
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-56516.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-56516
Aliases
  • GHSA-36cc-58vm-wm4h
Published
2024-12-30T16:19:47.571Z
Modified
2026-04-02T12:25:08.697763Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
free-one-api uses md5 for password storage
Details

free-one-api allows users to access large language model reverse engineering libraries through the standard OpenAI API format. In versions up to and including 1.0.1, MD5 is used to hash passwords before sending them to the backend. MD5 is a cryptographically broken hashing algorithm and is no longer considered secure for password storage or transmission. It is vulnerable to collision attacks and can be easily cracked using modern hardware, exposing user credentials to potential compromise. As of time of publication, a replacement for MD5 has not been committed to the free-one-api GitHub repository.

Database specific 
{
    "cwe_ids": [
        "CWE-328"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/56xxx/CVE-2024-56516.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/rockchinq/free-one-api

Affected ranges

Type
GIT
Repo
https://github.com/rockchinq/free-one-api
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
097b0f8720bebc23667ffab321ed5c589d4e7a89
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.0.1"
        }
    ]
}

Affected versions

v1.*
v1.0.0
v1.0.0-alpha.1
v1.0.0-alpha.2
v1.0.0-alpha.3
v1.0.0-alpha.4
v1.0.0-alpha.5
v1.0.0-beta.1
v1.0.0-beta.2
v1.0.0-beta.3
v1.0.0-beta.4
v1.0.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-56516.json"