The flaw lies in the diems SHA1-based password handling component, specifically in PluginDmUser.class.php. By manipulating the salt and password arguments, an attacker can compute a password hash with far less computational effort than intended, exposing users to faster offline cracking attempts. The weakness is a clear case of insufficient cryptographic strength (CWE-326) with an additional concern about inappropriate hash choice (CWE-916). While the CVSS score is low, the ability to reduce hashing effort increases the feasibility of credential compromise for local accounts.

All diem-project diem installations up to and including version 5.1.3 are affected, as the vulnerability resides in an unspecified part of lib/model/doctrine/PluginDmUser.class.php. No newer releases are listed as fixed, so the scope covers all current deployments of these versions.

The attack requires local access to the system and carries high complexity, which the CVE notes as difficult to execute. No EPSS value is available, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, the public disclosure indicates that the flaw could be leveraged by local attackers familiar with the codebase. Given the low CVSS score, the risk is considered low to moderate, but the impact of a successful exploit could lead to unauthorized account access.