Read the docs
TI-2024-19654 Aliases CVE-2024-29886GHSA-r75m-26cq-mjxc

Improved security for stored password hashes

Priority LOW 30CWE-916Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Serverpod is an app and web server, built for the Flutter and Dart ecosystem. An issue was identified with the old password hash algorithm that made it susceptible to rainbow attacks if the database was compromised. This vulnerability is fixed by 1.2.6.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00262 18th percentileScored 2026-11-07
Fix Fixed serverpod (serverpod): 1.2.6serverpod_auth_server (Pub): 1.2.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
serverpodserverpodbefore 1.2.61.2.6Patch availableCNA
—serverpod_auth_server (Pub)before 1.2.61.2.6Patch availableGHSA-r75m-26cq-mjxc
  • serverpod Vendorserverpod Affected before 1.2.6 Fixed in 1.2.6 Patch available CNA
  • serverpod_auth_server (Pub) Vendor— Affected before 1.2.6 Fixed in 1.2.6 Patch available GHSA-r75m-26cq-mjxc

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:serverpod:serverpod:*:*:*:*:*:*:*:*before 1.2.6Vulnerableserverpod
  • cpe:2.3:a:serverpod:serverpod:*:*:*:*:*:*:*:* Versions before 1.2.6 Vulnerable ·serverpod

Remediation

  • Fix · CNA serverpod (serverpod) Fixed in 1.2.6
  • Fix · GHSA-r75m-26cq-mjxc serverpod_auth_server (Pub) Fixed in 1.2.6 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-29886
  2. 2026-10-03 Alias added: GHSA-r75m-26cq-mjxc

References

Patch 1

Advisory 2

Other 1

  • TI-2024-19655 Serverpod client accepts any certificate CVSS 3.1HIGH 7.4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences