FrontAccounting versions up to 2.4.20 store and verify user passwords as unsalted MD5 digests. Because no salt is applied and the code does not use password_hash or password_verify, identical passwords produce identical digests, making it trivial for an attacker who obtains the user table to recover plaintext passwords with precomputed lookup tables or GPU‑accelerated cracking. This flaw directly undermines the confidentiality of user credentials and can enable unauthorized account access.

The affected vendor is FrontAccounting: FrontAccounting. All releases up to and including version 2.4.20 are vulnerable. Users running FrontAccounting 2.4.20 or earlier must evaluate their installations for the presence of this weakness.

The CVSS score of 8.2 marks this as a high‑severity vulnerability. Although the EPSS score is not reported, the lack of a per‑password salt means that an attacker who gains database access can efficiently compromise all stored passwords. The vulnerability is not listed in the CISA KEV catalog, but the attack vector is likely a database compromise or insider access, after which the attacker can recover passwords before any mitigation is applied.