CVE-2026-45027: WeGIA Auth Bypass Vulnerability

CVE-2026-45027 Overview

CVE-2026-45027 affects WeGIA, an open-source web manager for charitable institutions developed by LabRedesCefetRJ. The vulnerability stems from insecure password storage in versions prior to 3.7.3. The application hashes user passwords with PHP's hash() function using SHA-256 and no salt before comparing the digest against the stored value. This pattern appears in both html/login.php during authentication and controle/FuncionarioControle.php during password changes. The weakness falls under [CWE-759: Use of a One-Way Hash without a Salt]. The maintainers fixed the issue in version 3.7.3.

Critical Impact
An attacker who obtains the password database can recover plaintext credentials using precomputed rainbow tables, because identical passwords produce identical digests across all accounts.

Affected Products

WeGIA versions prior to 3.7.3
html/login.php authentication component
controle/FuncionarioControle.php password change component

Discovery Timeline

2026-05-27 - CVE-2026-45027 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-45027

Vulnerability Analysis

WeGIA stores user credentials as bare SHA-256 digests of the plaintext password. SHA-256 is a general-purpose cryptographic hash optimized for throughput, not for password storage. Modern GPUs compute billions of SHA-256 operations per second, making brute-force recovery practical against common passwords. The implementation compounds the issue by omitting a salt. Without per-user random salts, identical passwords across accounts produce identical digests, and a single precomputed rainbow table lookup can crack the entire credential store.

Root Cause

The root cause is the use of hash('sha256', $password) for credential storage instead of a password-specific Key Derivation Function (KDF). Secure password storage requires algorithms such as bcrypt, argon2, or PBKDF2, which incorporate per-credential salts and configurable work factors. PHP exposes these primitives through the password_hash() and password_verify() APIs, neither of which WeGIA invokes in the affected flows.

Attack Vector

Exploitation requires that an attacker first obtain the stored hash database, typically through a secondary vulnerability such as SQL injection, backup exposure, or insider access. Once the hashes are extracted, the attacker performs offline rainbow table lookups or GPU-accelerated dictionary attacks. The high attack complexity reflected in the CVSS vector accounts for this precondition. Recovered plaintext credentials enable account takeover and lateral movement within the affected institution.

No verified proof-of-concept code is published. See the GitHub Security Advisory for vendor details.

Detection Methods for CVE-2026-45027

Indicators of Compromise

Database dumps or backup files containing 64-character hexadecimal strings consistent with unsalted SHA-256 password columns.
Repeated identical hash values across multiple user records, indicating shared passwords exposed by the missing salt.
Unexpected outbound transfers of database files from servers hosting WeGIA installations.

Detection Strategies

Audit WeGIA installations for the affected functions hash('sha256', ...) in html/login.php and controle/FuncionarioControle.php.
Monitor authentication logs for credential stuffing or password spraying activity following any suspected database exposure.
Inspect web server and database logs for SQL injection or file inclusion attempts targeting the WeGIA user table.

Monitoring Recommendations

Alert on bulk read operations against the WeGIA user credentials table outside of administrative maintenance windows.
Track successful logins from new geolocations or user agents following exposure events.
Forward WeGIA application and database logs to a centralized SIEM for correlation with broader attack patterns.

How to Mitigate CVE-2026-45027

Immediate Actions Required

Upgrade WeGIA to version 3.7.3 or later, which replaces the unsalted SHA-256 implementation.
Force a password reset for all existing user accounts after upgrading, since legacy hashes remain weak until users authenticate again.
Restrict database access to the minimum required service accounts and review backup storage permissions.

Patch Information

The vulnerability is fixed in WeGIA version 3.7.3. Refer to the GitHub Security Advisory GHSA-hcgv-vmq6-j6qg for the official remediation notice from LabRedesCefetRJ.

Workarounds

If immediate patching is not possible, place the WeGIA application behind a web application firewall and restrict database network exposure.
Enforce strong password policies and multi-factor authentication to reduce the impact of credential recovery.
Rotate any credentials reused across WeGIA and other systems to limit blast radius from offline cracking.

bash

# After upgrading to 3.7.3, invalidate all existing password hashes
# and require users to set new passwords on next login.
UPDATE usuario SET senha = NULL, force_password_reset = 1;