MediumVulnerabilityLLM-specific
CVE-2024-56516: free-one-api MD5 password hashing exposes user credentials
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2024-56516
- Published
- Record updated
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.3%
Summary
CVE-2024-56516 affects free-one-api, which exposes large language model reverse engineering libraries through the standard OpenAI API format. Versions up to and including 1.0.1 hash passwords with MD5 before sending them to the backend. Because MD5 is vulnerable to collision attacks and can be cracked on modern hardware, user credentials are exposed to potential compromise.
Mitigation
The source does not state a fix yet. Check the original advisory for updates.