What is GHSA-7fv8-6pp7-6h85?

GHSA-7fv8-6pp7-6h85 is a security advisory published by GitHub Security Advisories with Medium severity. Sulu: Weak Cryptographical usage for API Key generation and Reset Tokens

Which CVE IDs does GHSA-7fv8-6pp7-6h85 cover?

GHSA-7fv8-6pp7-6h85 covers the following CVE IDs: CVE-2026-45701. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-7fv8-6pp7-6h85?

GHSA-7fv8-6pp7-6h85 affects 2 products, including: composer/sulu/sulu:\u003e= 3.0.0-alpha1, \u003c= 3.0.5; composer/sulu/sulu:\u003c= 2.6.22.

GHSA-7fv8-6pp7-6h85Medium

Sulu: Weak Cryptographical usage for API Key generation and Reset Tokens

Vendor

GitHub Security Advisories

Published

May 18, 2026

Last Modified

May 18, 2026

🔗 CVE IDs covered (1)

CVE-2026-45701 →

📋 Description

Impact

The password reset tokenand API key generation uses a weak cryptographical hash algorithm.

Patches

Fixed in 2.6.23 and 3.0.6 version.

Workarounds

Patch the related User.php and ResettingController.php file in the SecurityBundle.

🎯 Affected products2

composer/sulu/sulu:>= 3.0.0-alpha1, <= 3.0.5
composer/sulu/sulu:<= 2.6.22

🔗 References (4)

https://github.com/sulu/sulu/security/advisories/GHSA-7fv8-6pp7-6h85
https://github.com/sulu/sulu/releases/tag/2.6.23
https://github.com/sulu/sulu/releases/tag/3.0.6
https://github.com/advisories/GHSA-7fv8-6pp7-6h85