Xxyopen novel versions up to 3.5.0 use a weak password hashing mechanism: an unsalted MD5 digest is stored in the user_info.password column. This weakness, identified as CWE-916, allows an attacker with access to the stored hash to recover the original plaintext password using pre‑computed tables or brute‑force techniques.

The affected product is the Xxyopen novel application, with all releases through version 3.5.0. Earlier releases are also affected, as the same implementation was used in those versions. The vulnerability is limited to the password storage component and does not involve any remote code execution or privileged escalation.

The CVSS score of 8.2 indicates a high severity vulnerability, but exploitation requires obtaining the password column, typically via a database breach, backup exposure, or misconfigured database privileges. While the EPSS score is not available and the CVE is not listed in CISA’s KEV catalog, the lack of salting means an attacker who obtains hashed passwords can recover them quickly with readily available GPU‑accelerated tools or rainbow tables, posing a significant risk of credential compromise and potential lateral movement.