CVE-2026-34527

Sandboxie-Plus is an open source sandbox-based isolation software for Windows. In versions 1.17.2 and earlier, SbieIniServer::HashPassword converts a SHA-1 digest to hexadecimal incorrectly. The high nibble of each byte is shifted right by 8 instead of 4, which always produces zero for an 8-bit value. As a result, the stored EditPassword hash only preserves the low nibble of each digest byte, reducing the effective entropy from 160 bits to 80 bits. This is layered on top of an unsalted SHA-1 scheme. The reduced entropy makes leaked or backed-up password hashes materially easier to brute-force. This issue has been fixed in version 1.17.3.

• CWE-328

• https://github.com/sandboxie-plus/Sandboxie/security/advisories/GHSA-w37h-qm9p-h4x2Mitigation, Vendor Advisory
• https://github.com/sandboxie-plus/Sandboxie/security/advisories/GHSA-w37h-qm9p-h4x2Mitigation, Vendor Advisory

Published

May 5, 2026

Last Modified

Jul 24, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-34520AIOHTTP is an asynchronous HTTP client/server framework for …9.1
• CVE-2026-34522SillyTavern is a locally installed user interface that allow…8.1
• CVE-2026-34523SillyTavern is a locally installed user interface that allow…5.3
• CVE-2026-34524SillyTavern is a locally installed user interface that allow…8.8
• CVE-2026-34525AIOHTTP is an asynchronous HTTP client/server framework for …5.3
• CVE-2026-34526SillyTavern is a locally installed user interface that allow…5
• CVE-2026-34528File Browser is a file managing interface for uploading, del…9.8
• CVE-2026-34529File Browser is a file managing interface for uploading, del…9
• CVE-2026-3453The ProfilePress plugin for WordPress is vulnerable to Insec…8.1
• CVE-2026-34530File Browser is a file managing interface for uploading, del…6.9
• CVE-2026-34531Flask-HTTPAuth provides Basic, Digest and Token HTTP authent…8.2
• CVE-2026-34532Parse Server is an open source backend that can be deployed …9.1