AIKIDO-2025-10942

TL;DR

Affected versions of this package are vulnerable to a parameter splicing vulnerability in the salt handling logic where the application failed to consistently enforce a delimiter, allowing an attacker to exploit this by injecting a custom delimiter into the salt parameter to maliciously splice and control the resulting composite string, thereby enabling authentication bypass or replay attacks where a previously observed hashed value could be fraudulently reused.