CVE-2026-45701— Sulu: Weak Cryptographical usage for API Key generation and Reset Tokens
Possible ATT&CK Techniques 1AI
T1552.004 · Private KeysGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-45701
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Sulu: Weak Cryptographical usage for API Key generation and Reset Tokens
Source: NVD (National Vulnerability Database)
Vulnerability Description
Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.23 and 3.0.6, the password reset tokenand API key generation uses a weak cryptographical hash algorithm. This issue has been patched in versions 2.6.23 and 3.0.6.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
使用已被攻破或存在风险的密码学算法
Source: NVD (National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-45701
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-45701
请登录查看更多情报信息。
Patches & Fixes for CVE-2026-45701 (1)
- 🔗 Release Release 2.6.23 (2026-05-04) · sulu/sulu · GitHubx_refsource_MISC
Vendor Advisories for CVE-2026-45701 (1)
IV. Related Vulnerabilities
Same product: sulu
- CVE-2026-34372
Sulu checks fix permissions for subentities endpoints - CVE-2025-47778
Sulu vulnerable to XXE in SVG File upload Inspector - CVE-2024-47617
Reflected XSS Vulnerability in Sulu Media Bundle - CVE-2024-47618
Sulu vulnerable to XSS via uploaded SVG - CVE-2024-27915
Sulu grants access to pages regardless of role permissions
Same vendor: sulu
- CVE-2026-34372
Sulu checks fix permissions for subentities endpoints - CVE-2025-47778
Sulu vulnerable to XXE in SVG File upload Inspector - CVE-2024-47617
Reflected XSS Vulnerability in Sulu Media Bundle - CVE-2024-47618
Sulu vulnerable to XSS via uploaded SVG - CVE-2024-37156
TokenController formName not sanitized in hidden input
Same weakness: CWE-327
- CVE-2025-46371
Dell PowerFlex Manager 加密问题漏洞 - CVE-2026-44053
Weak cryptography in DHCAST128 UAM - CVE-2026-44699
LibJWT: Algorithm confusion allows JWT forgery with RSA JWK - CVE-2026-8072
Insecure generation of SAT access credentials in Ingecon EMS - CVE-2026-6411
MAXHUB Pivot Client Application Use of a Broken or Risky Cry
V. Comments for CVE-2026-45701
No comments yet