CVE-2026-88837 — Busybox: busybox: httpd misidentifies yescrypt password hashes as plaintext, inverting authentication

CVE-2026-88837

Busybox: busybox: httpd misidentifies yescrypt password hashes as plaintext, inverting authentication PUBLISHED

Description (CNA)

BusyBox httpd treats yescrypt ($y$) password hashes as plaintext during Basic Authentication, inverting the authentication check.

Vendor / product	Versions
Red Hat / Red Hat Hardened Images	unaffected 1.37.0-9.1.hum1 before *

CWE-305

CISA-ADP

No English description supplied.

No references supplied.