{"id":"CVE-2022-1235","aliases":["BIT-livehelperchat-2022-1235","GHSA-vx8v-g3p3-88vg"],"url":"https://o3.security/vulnerability/CVE-2022-1235","summary":"Weak secrethash can be brute-forced in livehelperchat/livehelperchat","details":"The secrethash, which the application relies for multiple security measures, can be brute-forced. The hash is quite small, with only 10 characters of only hexadecimal, making 16^10 possilibities ( 1.099.511.627.776 ). The SHA1 of the secret can be obtained via a captcha string and brute-forced offline with an GPU.","published":"2022-04-05T06:30:15Z","modified":"2026-08-12T03:51:37.889285758Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"},"epss":{"score":0.00547,"percentile":0.43433,"asOf":"2026-08-23"},"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"Packagist","name":"remdex/livehelperchat","fixedVersion":"3.96"}],"fix":{"url":"https://github.com/livehelperchat/livehelperchat/commit/6538d6df3d8a60fee254170b08dd76a161f7bfdc","label":"livehelperchat/livehelperchat@6538d6d"},"references":[{"type":"WEB","url":"https://huntr.dev/bounties/92f7b2d4-fa88-4c62-a2ee-721eebe01705"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/1xxx/CVE-2022-1235.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-1235"},{"type":"FIX","url":"https://github.com/livehelperchat/livehelperchat/commit/6538d6df3d8a60fee254170b08dd76a161f7bfdc"},{"type":"PACKAGE","url":"https://github.com/livehelperchat/livehelperchat"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:37.889285758Z"}}