ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2024-29886

Serverpod improved security for stored password hashes

Published Mar 28, 2024 · catalog updated Sep 10, 2026 · Serverpod improved security for

Check if you run it

No confirmed exploitation is on record for CVE-2024-29886. EPSS is 0.26%. Act only if a listed version of Serverpod improved security for is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (Serverpod improved security for).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Medium5.3
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.26%
Remediation
Advisory link
Affected products
Pub serverpod_auth_server

## Description ### Improved security for stored password hashes Serverpod now uses the OWASP, [source](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#introduction), recommended Argon2Id password hash algorithm to store password hashes for the email authentication module. Starting from Serverpod all users that either creates an account or authenticates with the server will have their password stored using the safer algorithm. No changes are required from the developer to start storing passwords using the safer algorithm. ### Why did we change how passwords are stored? An issue was identified with the old password hash algorithm that made it susceptible to rainbow attacks if the database was compromised. It is strongly recommended to migrate your existing password hashes. ### Migrate existing password hashes The email authentication module provides a helper method to migrate all the existing legacy password hashes in the database. Simply call with a session instance as an argument to migrate the password hashes. The method is implemented as an idempotent operation and will yield the same result regardless of how many times it is called. We recommend either implementing a web server route that can be called remotely or by calling the method as part of starting the server. Following is example code for implementing a web server route. Web server route code ### How we migrate existing password hashes Since password hashes can’t be recalculated without knowledge of the plain text password, the method in the email authentication module applies the new algorithm to the already stored password hashes. When the affected users later authenticate, their password hash will be calculated using both algorithms in tandem. If the authentication is accepted, the stored password hash will be updated to only use the new algorithm so that further authentication only needs to run the new algorithm. ### Impact All versions of pre ### Patches Upgrading to

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • Pub serverpod_auth_server0 → 1.2.6

How to fix CVE-2024-29886

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2024-29886. EPSS is 0.26%. Act only if a listed version of Serverpod improved security for is installed.

Which versions are affected?

Compare what you have installed with 0 → 1.2.6. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-916. EPSS 0.26%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 28, 2024 · GitHub Advisory Database

    Detected

    ## Description ### Improved security for stored password hashes Serverpod now uses the OWASP, [source](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#introduction), recommended Argon2Id password hash algorithm to store password hashes for the email authentication module. Starting from Serverpod all users that either creates an account or authenticates with the ser

  2. Sep 10, 2026 · GitHub Advisory Database

    Fix available

    serverpod_auth_server fixed in 1.2.6

  3. Sep 10, 2026 · GitHub Advisory Database

    Fix available

    serverpod_auth_server fixed in 1.2.6

  4. Sep 10, 2026 · GitHub Advisory Database

    Updated

    ## Description ### Improved security for stored password hashes Serverpod now uses the OWASP, [source](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html#introduction), recommended Argon2Id password hash algorithm to store password hashes for the email authentication module. Starting from Serverpod all users that either creates an account or authenticates with the ser

Sources

References

Freshness

Last verified in this catalog Oct 16, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.