CVE-2025-56608

The SourceCodester Android application "Corona Virus Tracker App India" 1.0 uses MD5 for digest authentication in `OkHttpClientWrapper.java`. The `handleDigest()` function employs `MessageDigest.getInstance("MD5")` to hash credentials. MD5 is a broken cryptographic algorithm known to allow hash collisions. This makes the authentication mechanism vulnerable to replay, spoofing, or brute-force attacks, potentially leading to unauthorized access. The vulnerability corresponds to CWE-327 and aligns with OWASP M5: Insufficient Cryptography and MASVS MSTG-CRYPTO-4.

• CWE-290

• https://github.com/MobSF/owasp-mstg/blob/master/Document/0x04g-Testing-Cryptography.md#identifying-insecure-andor-deprecated-cryptographic-algorithms-mstg-crypto-4Technical Description
• https://github.com/anonaninda/Aninda-security-advisories/blob/main/CVE-2025-56608.mdThird Party Advisory
• https://www.sourcecodester.com/android/14292/android-corona-virus-tracker-app-india-using-b4a.htmlProduct

Published

Sep 3, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8nStrix found an identity-binding bug in n8n's token-exchange flow enabling account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-56588Dolibarr ERP & CRM v21.0.1 were discovered to contain a remo…8.8
• CVE-2025-56589A Local File Inclusion (LFI) and a Server-Side Request Forge…7.5
• CVE-2025-5659A vulnerability classified as critical was found in PHPGuruk…8.8
• CVE-2025-56590An issue was discovered in the InsertFromURL() function of t…9.8
• CVE-2025-5660A vulnerability, which was classified as critical, has been …8.8
• CVE-2025-56605A reflected Cross-Site Scripting (XSS) vulnerability exists …5.4
• CVE-2025-5661A vulnerability, which was classified as problematic, was fo…5.4
• CVE-2025-5662A deserialization vulnerability exists in the H2O-3 REST API…9.8
• CVE-2025-5663A vulnerability has been found in PHPGurukul Auto Taxi Stand…9.8
• CVE-2025-56630FoxCMS v1.2.5 and before is vulnerable to SQL Injection via …7.3
• CVE-2025-5664A vulnerability was found in FreeFloat FTP Server 1.0 and cl…9.8
• CVE-2025-56643Requarks Wiki.js 2.5.307 does not properly revoke or invalid…9.1