Sulu uses an insecure hash algorithm to generate password reset tokens and API keys, making these credentials vulnerable to prediction or brute‑force attacks. The weakness is classified as CWE‑327 and could allow an attacker to gain unauthorized access to user accounts or abuse the system’s API. The vulnerability exists in all releases prior to the fixes applied in versions 2.6.23 and 3.0.6.

All versions of Sulu before 2.6.23 (for the 2.x series) and before 3.0.6 (for the 3.x series) are affected. The patches that address the weak hash are contained in the 2.6.23 and 3.0.6 releases, so administrators should upgrade to one of those or later. No specific sub‑components are singled out, but any installation that still uses the legacy token generation code is considered vulnerable.

The CVSS score of 6.9 denotes a medium impact, reflecting significant risk but not immediate catastrophic potential. EPSS information is not available, and the vulnerability is not listed in CISA’s KEV catalog. The likely attack vectors are remote and rely on the web interface or API to trigger password resets or request API keys. An attacker who can predict or brute‑force the weak tokens can hijack accounts or perform unauthorized API calls; the exposure depends on whether residual tokens are still in circulation.