TI-2026-83040 Aliases CVE-2026-110971 GHSA-wjj3-64hr-pjh8

Weak password encoding in Płatnik lets users decode passwords

LOW 35CWE-261Published 2026-10-30 · Updated 2026-11-03

Key facts

Attack vector: Adjacent network
Privileges required: None
User interaction: None
Attack complexity: High
Attack requirements: None
Impact type: —
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Płatnik software by Zakład Ubezpieczeń Społecznych, versions from 0 through 10.02.002, uses a weak encoding algorithm for passwords (CWE-261). A user who obtains an encoded password can decode it easily.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Description from the CNA

Use of a weak password encoding algorithm in Płatnik software allows a user who obtains encoded password to easily decode it. This issue was fixed in metric 334 in version 10.02.002.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0017 6th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Zakład Ubezpieczeń Społecznych	Płatnik	up to 10.02.002	—	No fix listed	CNA

Płatnik VendorZakład Ubezpieczeń Społecznych Affected up to 10.02.002 Fixed in — No fix listed CNA

Remediation

The source description says the issue was fixed in metric 334 in version 10.02.002.

Written with Claude Haiku 5.5 from the sources below · 2026-11-03

Timeline

2026-10-30 Threatist record created from CVE-2026-110971
2026-10-30 Alias added: GHSA-wjj3-64hr-pjh8
2026-10-30 CISA SSVC decision points changed
2026-10-30 Priority changed: MEDIUM → LOW

References

Advisory 1

https://cert.pl/posts/2026/10/CVE-2026-110970

Other 1

https://www.zus.pl/firmy/program-platnik/o-programie-platnik

TI-2026-83041 Client-side authentication in Płatnik allows login as any user CVSS 4.0HIGH 8.6
TI-2026-83039 Unencrypted HTTP downloads in Płatnik allow man-in-the-middle attacks CVSS 4.0LOW 2.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences