What is CVE-2026-55164?
A vulnerability was discovered in Lemur, a TLS certificate management tool. Prior to version 1.9.2, when an administrator updated a user's password, the password was directly assigned, but because no `before_update` listener was registered for the `hash_password` function, the password was not properly hashed. This could lead to passwords being stored in plaintext, increasing the risk of account takeover.
Azərbaycanca: Lemur TLS sertifikat idarəetmə alətində CVE-2026-55164 zəifliyi aşkar edilib. 1.9.2 versiyasından əvvəl, administrator tərəfindən istifadəçi şifrəsi yeniləməsi zamanı şifrə birbaşa yadda saxlanılır, lakin `before_update` hadisə siyahıçısı olmadığı üçün `hash_password` funksiyası işə düşmürdü. Nəticədə şifrələr açıq mətn şəklində saxlanıla bilir, bu da hesab ələ keçirmə riskini artırır.
Related CVEs
link basis: same weakness class CWE-522
FAQ2
Which versions of the Lemur tool are affected by CVE-2026-55164?
The CVE-2026-55164 vulnerability affects versions of the Lemur TLS certificate management tool prior to 1.9.2.
What is the root cause of the CVE-2026-55164 vulnerability?
The root cause of the vulnerability is that when an administrator updates a user's password, the `hash_password` function is not triggered due to the absence of a `before_update` listener.
See also6
This explainer is AI-written from source data — skopnix's own reporting on this CVE; CVSS scores, vendors and versions are never invented. See NVD for the official record.