BusyBox httpd misidentifies yescrypt ($y$) password hashes as plaintext during HTTP Basic Authentication, causing the server to treat the stored hash string as a clear‑text password. When a client supplies the same hash string, the comparison passes and the user is granted access, effectively bypassing proper authentication. The effect is that an attacker who can observe or guess the hash string can authenticate without the actual plaintext password, compromising confidentiality and integrity of protected resources.

The vulnerability appears in BusyBox httpd packaged within Red Hat Hardened Images, specifically Hummingbird 1 (CPE: cpe:/a:redhat:hummingbird:1). Any deployment of this image that exposes a password‑protected HTTP resource using BusyBox httpd is potentially affected.

The CVSS score of 6.5 indicates moderate severity. EPSS is not available and the vulnerability is not listed in CISA KEV, suggesting limited current exploitation activity. The likely attack vector is remote over the network, as HTTP Basic Authentication is transmitted over ports accessible to attackers. Exploitation would require the attacker to supply the exact yescrypt hash string, which may be hard to discover, but the risk is significant if credentials are exposed or guessed.