GitHub Advisoryadvisory · Packagist

GHSA-7fv8-6pp7-6h85 Sulu: Weak Cryptographical usage for API Key generation and Reset Tokens

MEDIUM Published 2026-05-18 Modified 2026-06-09 Official page ↗
Aliases
CVE-2026-45701
Ecosystem
Packagist
Packages
sulu/sulu
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Weaknesses
CWE-327
Reviewed
2026-05-18

Affected packages

• Packagist sulu/sulu: >= 3.0.0-alpha1, < 3.0.6 → fixed in 3.0.6 • Packagist sulu/sulu: < 2.6.23 → fixed in 2.6.23

Description

Impact The password reset tokenand API key generation uses a weak cryptographical hash algorithm. Patches Fixed in 2.6.23 and 3.0.6 version. Workarounds Patch the related `User.php` and `ResettingController.php` file in the SecurityBundle.

Related

Alias · CVE (1)

  • CVE-2026-45701 Sulu is an open-source PHP content management system based on the Symfony framework. vulnerability

Weakness · CWE (1)

  • CWE-327 Use of a Broken or Risky Cryptographic Algorithm weakness

References