{"id":"CVE-2025-56608","aliases":["EUVD-2025-26519","GHSA-wffj-85j3-x844"],"status":"published","title":"The SourceCodester Android application \"Corona Virus Tracker App India\" 1.0 uses MD5 for digest...","description":"The SourceCodester Android application \"Corona Virus Tracker App India\" 1.0 uses MD5 for digest authentication in `OkHttpClientWrapper.java`. The `handleDigest()` function employs `MessageDigest.getInstance(\"MD5\")` to hash credentials. MD5 is a broken cryptographic algorithm known to allow hash collisions. This makes the authentication mechanism vulnerable to replay, spoofing, or brute-force attacks, potentially leading to unauthorized access. The vulnerability corresponds to CWE-327 and aligns with OWASP M5: Insufficient Cryptography and MASVS MSTG-CRYPTO-4.","severity":{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00328,"percentile":0.26254,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-290"],"published":"2025-09-03T00:00:00Z","modified":"2026-11-07T18:10:00Z","exploits":[{"source":"pocgithub","id":"anonaninda/Aninda-security-advisories","title":"anonaninda/Aninda-security-advisories","date":"2025-09-02","url":"https://github.com/anonaninda/Aninda-security-advisories"}],"products":[{"vendor":"donbermoy","product":"android_corona_virus_tracker_app_for_india"}],"references":[{"url":"https://www.sourcecodester.com/android/14292/android-corona-virus-tracker-app-india-using-b4a.html","tags":["Product","web"]},{"url":"https://github.com/MobSF/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#identifying-insecure-andor-deprecated-cryptographic-algorithms-mstg-crypto-4","tags":["Technical Description","web"]},{"url":"https://github.com/anonaninda/Aninda-security-advisories/blob/main/CVE-2025-56608.md","tags":["Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-56608","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-wffj-85j3-x844"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/56xxx/CVE-2025-56608.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-56608","description":"The SourceCodester Android application \"Corona Virus Tracker App India\" 1.0 uses MD5 for digest authentication in `OkHttpClientWrapper.java`. The `handleDigest()` function employs `MessageDigest.getInstance(\"MD5\")` to hash credentials. MD5 is a broken cryptographic algorithm known to allow hash collisions. This makes the authentication mechanism vulnerable to replay, spoofing, or brute-force attacks, potentially leading to unauthorized access. The vulnerability corresponds to CWE-327 and aligns with OWASP M5: Insufficient Cryptography and MASVS MSTG-CRYPTO-4.","status":"published","published":"2025-09-03T00:00:00Z","modified":"2025-09-03T19:09:03.703Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-290"],"updated_at":"2026-11-02T14:32:26.320248Z"}],"euvd":[{"id":"EUVD-2025-26519","description":"The SourceCodester Android application \"Corona Virus Tracker App India\" 1.0 uses MD5 for digest authentication in `OkHttpClientWrapper.java`. The `handleDigest()` function employs `MessageDigest.getInstance(\"MD5\")` to hash credentials. MD5 is a broken cryptographic algorithm known to allow hash collisions. This makes the authentication mechanism vulnerable to replay, spoofing, or brute-force attacks, potentially leading to unauthorized access. The vulnerability corresponds to CWE-327 and aligns with OWASP M5: Insufficient Cryptography and MASVS MSTG-CRYPTO-4.","status":"published","published":"2025-09-03T00:00:00Z","modified":"2025-09-03T19:09:03Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:31:47.847286Z"}],"ghsa":[{"id":"GHSA-wffj-85j3-x844","title":"The SourceCodester Android application \"Corona Virus Tracker App India\" 1.0 uses MD5 for digest...","description":"The SourceCodester Android application \"Corona Virus Tracker App India\" 1.0 uses MD5 for digest authentication in `OkHttpClientWrapper.java`. The `handleDigest()` function employs `MessageDigest.getInstance(\"MD5\")` to hash credentials. MD5 is a broken cryptographic algorithm known to allow hash collisions. This makes the authentication mechanism vulnerable to replay, spoofing, or brute-force attacks, potentially leading to unauthorized access. The vulnerability corresponds to CWE-327 and aligns with OWASP M5: Insufficient Cryptography and MASVS MSTG-CRYPTO-4.","status":"published","published":"2025-09-03T15:30:34Z","modified":"2025-09-08T18:31:30Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-290"],"updated_at":"2026-11-02T15:03:31.573808Z"}],"nvd":[{"id":"CVE-2025-56608","description":"The SourceCodester Android application \"Corona Virus Tracker App India\" 1.0 uses MD5 for digest authentication in `OkHttpClientWrapper.java`. The `handleDigest()` function employs `MessageDigest.getInstance(\"MD5\")` to hash credentials. MD5 is a broken cryptographic algorithm known to allow hash collisions. This makes the authentication mechanism vulnerable to replay, spoofing, or brute-force attacks, potentially leading to unauthorized access. The vulnerability corresponds to CWE-327 and aligns with OWASP M5: Insufficient Cryptography and MASVS MSTG-CRYPTO-4.","status":"published","published":"2025-09-03T15:15:37.66Z","modified":"2026-11-07T18:10:00.2Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-290"],"updated_at":"2026-11-07T20:06:28.095135Z"}],"osv":[{"id":"CVE-2025-56608","description":"The SourceCodester Android application \"Corona Virus Tracker App India\" 1.0 uses MD5 for digest authentication in `OkHttpClientWrapper.java`. The `handleDigest()` function employs `MessageDigest.getInstance(\"MD5\")` to hash credentials. MD5 is a broken cryptographic algorithm known to allow hash collisions. This makes the authentication mechanism vulnerable to replay, spoofing, or brute-force attacks, potentially leading to unauthorized access. The vulnerability corresponds to CWE-327 and aligns with OWASP M5: Insufficient Cryptography and MASVS MSTG-CRYPTO-4.","status":"published","published":"2025-09-03T00:00:00Z","modified":"2026-11-09T02:31:02.920963564Z","cvss":[{"version":"3.1","score":4.2,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-09T03:16:44.651171Z"}]}}