CVE-2024-56516

free-one-api allows users to access large language model reverse engineering libraries through the standard OpenAI API format. In versions up to and including 1.0.1, MD5 is used to hash passwords before sending them to the backend. MD5 is a cryptographically broken hashing algorithm and is no longer considered secure for password storage or transmission. It is vulnerable to collision attacks and can be easily cracked using modern hardware, exposing user credentials to potential compromise. As of time of publication, a replacement for MD5 has not been committed to the free-one-api GitHub repository.

CVSS

No CVSS.

References

Link	Resource
https://github.com/RockChinQ/free-one-api/blob/4d6ee42ffbb224b95be32c26cabc28d54d01bf78/web/src/main.js#L15
https://github.com/RockChinQ/free-one-api/security/advisories/GHSA-36cc-58vm-wm4h

Configurations

No configuration.

History

15 Apr 2026, 00:35

Type	Values Removed	Values Added
Summary		(es) free-one-api permite a los usuarios acceder a grandes librerías de ingeniería inversa de modelos de lenguaje a través del formato estándar de API de OpenAI. En versiones hasta la 1.0.1 incluida, se utiliza MD5 para codificar las contraseñas antes de enviarlas al backend. MD5 es un algoritmo de codificación criptográficamente defectuoso y ya no se considera seguro para el almacenamiento o la transmisión de contraseñas. Es vulnerable a ataques de colisión y se puede descifrar fácilmente con hardware moderno, lo que expone las credenciales de los usuarios a un posible riesgo. Al momento de la publicación, no se ha enviado un reemplazo para MD5 al repositorio de GitHub de free-one-api.

30 Dec 2024, 17:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-12-30 17:15

Updated : 2026-06-17 08:12

NVD link : CVE-2024-56516

Mitre link : CVE-2024-56516

CVE.ORG link : CVE-2024-56516

JSON object : View

Products Affected

No product.

CWE

CWE-328

Use of Weak Hash

{"id": "CVE-2024-56516", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-56516", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2024-12-30T16:48:13.058983Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "RockChinQ", "product": "free-one-api", "versions": [{"status": "affected", "version": "<= 1.0.1"}]}]}], "published": "2024-12-30T17:15:09.687", "references": [{"url": "https://github.com/RockChinQ/free-one-api/blob/4d6ee42ffbb224b95be32c26cabc28d54d01bf78/web/src/main.js#L15", "source": "security-advisories@github.com"}, {"url": "https://github.com/RockChinQ/free-one-api/security/advisories/GHSA-36cc-58vm-wm4h", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-328"}]}], "descriptions": [{"lang": "en", "value": "free-one-api allows users to access large language model reverse engineering libraries through the standard OpenAI API format. In versions up to and including 1.0.1, MD5 is used to hash passwords before sending them to the backend. MD5 is a cryptographically broken hashing algorithm and is no longer considered secure for password storage or transmission. It is vulnerable to collision attacks and can be easily cracked using modern hardware, exposing user credentials to potential compromise. As of time of publication, a replacement for MD5 has not been committed to the free-one-api GitHub repository."}, {"lang": "es", "value": "free-one-api permite a los usuarios acceder a grandes librer\u00edas de ingenier\u00eda inversa de modelos de lenguaje a trav\u00e9s del formato est\u00e1ndar de API de OpenAI. En versiones hasta la 1.0.1 incluida, se utiliza MD5 para codificar las contrase\u00f1as antes de enviarlas al backend. MD5 es un algoritmo de codificaci\u00f3n criptogr\u00e1ficamente defectuoso y ya no se considera seguro para el almacenamiento o la transmisi\u00f3n de contrase\u00f1as. Es vulnerable a ataques de colisi\u00f3n y se puede descifrar f\u00e1cilmente con hardware moderno, lo que expone las credenciales de los usuarios a un posible riesgo. Al momento de la publicaci\u00f3n, no se ha enviado un reemplazo para MD5 al repositorio de GitHub de free-one-api."}], "lastModified": "2026-06-17T08:12:16.937", "sourceIdentifier": "security-advisories@github.com"}