CVE-2016-2379
The Mxit protocol uses weak encryption when encrypting user passwords, which might allow...
CVE-2016-2379 is a high vulnerability (CVSS 8.8) in Pidgin Mxit, published March 29, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.40%, the 34th percentile. No source names a fixed version.
The Mxit protocol uses weak encryption when encrypting user passwords, which might allow attackers to (1) decrypt hashed passwords by leveraging knowledge of client registration codes or (2) gain login access by eavesdropping on login messages and re-using the hashed passwords.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
The Mxit protocol uses weak encryption when encrypting user passwords, which might allow attackers to (1) decrypt hashed passwords by leveraging knowledge of client registration codes or (2) gain login access by eavesdropping on login messages and re-using the hashed passwords.
- Record
CVE-2016-2379- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 3.3 Low
AV:A/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-326
- Updated
- 2026-11-02
CVE List No score
The Mxit protocol uses weak encryption when encrypting user passwords, which might allow attackers to (1) decrypt hashed passwords by leveraging knowledge of client registration codes or (2) gain login access by eavesdropping on login messages and re-using the hashed passwords.
- Record
CVE-2016-2379- Updated
- 2026-11-02
EUVDEUVD-2016-3463 No score
The Mxit protocol uses weak encryption when encrypting user passwords, which might allow attackers to (1) decrypt hashed passwords by leveraging knowledge of client registration codes or (2) gain login access by eavesdropping on login messages and re-using the hashed passwords.
- Record
EUVD-2016-3463- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-465g-5cj6-wf64
The Mxit protocol uses weak encryption when encrypting user passwords, which might allow...
The Mxit protocol uses weak encryption when encrypting user passwords, which might allow attackers to (1) decrypt hashed passwords by leveraging knowledge of client registration codes or (2) gain login access by eavesdropping on login messages and re-using the hashed passwords.
- Record
GHSA-465g-5cj6-wf64- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-326
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2016-2379
The Mxit protocol uses weak encryption when encrypting user passwords, which might allow attackers to (1) decrypt hashed passwords by leveraging knowledge of client registration codes or (2) gain login access by eavesdropping on login messages and re-using the hashed passwords.
- Record
UBUNTU-CVE-2016-2379- CVSS 3.0
- 8.8 High
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pidginUbuntu:14.04:LTS |
All versions, plus listed versions 1:2.10.7-0ubuntu4.11:2.10.7-0ubuntu4.21:2.10.9-0ubuntu11:2.10.9-0ubuntu21:2.10.9-0ubuntu3 Show 4 moreShow less1:2.10.9-0ubuntu3.11:2.10.9-0ubuntu3.21:2.10.9-0ubuntu3.31:2.10.9-0ubuntu3.4 |
None known |
pidginUbuntu:16.04:LTS |
All versions, plus listed versions 1:2.10.11-0ubuntu41:2.10.11-0ubuntu51:2.10.12-0ubuntu11:2.10.12-0ubuntu21:2.10.12-0ubuntu3 Show 4 moreShow less1:2.10.12-0ubuntu41:2.10.12-0ubuntu51:2.10.12-0ubuntu5.11:2.10.12-0ubuntu5.2 |
None known |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |