PT-2025-11695 · Beta80 · Beta80 Life 1St

Published 2025-03-19 · Updated 2025-03-19 · CVE-2025-26486

Positive Technologies (AI Summary)

CVSS v3.1

6.0

Medium

Base vector

AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Beta80 Life 1st version 1.5.2.14234

Description The issue involves the use of a broken or risky cryptographic algorithm, including the use of password hash with insufficient computational effort, use of weak hash, and use of a one-way hash with a predictable salt. This allows an attacker to bruteforce user passwords or find a collision to gain access to a target application using the BETA80 “Life 1st Identity Manager” as a service for authentication.

Recommendations For version 1.5.2.14234, consider updating the cryptographic algorithm to a more secure one, and increase the computational effort for password hashing to prevent bruteforce attacks. As a temporary workaround, restrict access to the Life 1st Identity Manager service to minimize the risk of exploitation.

Fix

Use of a Broken Cryptographic Algorithm

Weakness Enumeration

CWE-916

CWE-760

CWE-328

CWE-327

Related Identifiers

CVE-2025-26486

Affected Products

Beta80 Life 1St

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2025-26486 · Security Note
• https://twitter.com/CVEnew/status/1902387396324524466 · Twitter Post
• https://euvd.enisa.europa.eu/vulnerability/CVE-2025-26486 · Note
• https://t.me/cvetracker/19445 · Telegram Post
• https://t.me/cvedetector/20648 · Telegram Post
• https://cvcn.gov.it/cvcn/cve/CVE-2025-26486 · Note