CVE-2024-48928

Piwigo is an open source photo gallery application for the web. In versions on the 14.x branch, when installing, the secret_key configuration parameter is set to MD5(RAND()) in MySQL. However, RAND() only has 30 bits of randomness, making it feasible to brute-force the secret key. The CSRF token is constructed partially from the secret key, and this can be used to check if the brute force succeeded. Trying all possible values takes approximately one hour. The impact of this is limited. The auto login key uses the user's password on top of the secret key. The pwg token uses the user's session identifier on top of the secret key. It seems that values for get_ephemeral_key can be generated when one knows the secret key. Version 15.0.0 contains a fix for the issue.

• CWE-330

• https://github.com/Piwigo/Piwigo/commit/552499e0533ce54b55f4304b41ca6cd7ccce51f8Patch
• https://github.com/Piwigo/Piwigo/security/advisories/GHSA-hghg-37rg-7r42Vendor Advisory

Published

Feb 24, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-48920PutongOJ is online judging software. Prior to version 2.1.0-…9.1
• CVE-2024-48921Kyverno is a policy engine designed for Kubernetes. A kyvern…2.7
• CVE-2024-48924### Impact When this library is used to deserialize message…8.7
• CVE-2024-48925Umbraco, a free and open source .NET content management syst…6.5
• CVE-2024-48926Umbraco, a free and open source .NET content management syst…3.1
• CVE-2024-48927Umbraco, a free and open source .NET content management syst…4.6
• CVE-2024-48929Umbraco is a free and open source .NET content management sy…4.2
• CVE-2024-4893DigiWin EasyFlow .NET lacks validation for certain input par…9.8
• CVE-2024-48930secp256k1-node is a Node.js binding for an Optimized C libra…8.7
• CVE-2024-48931ZimaOS is a fork of CasaOS, an operating system for Zima dev…7.5
• CVE-2024-48932ZimaOS is a fork of CasaOS, an operating system for Zima dev…5.3
• CVE-2024-48933A cross-site scripting (XSS) vulnerability in LemonLDAP::NG …6.1