CVE-2019-20138

CVE-2019-20138 describes a weak password hashing vulnerability in the HTTP Authentication library for Nim, affecting versions prior to 2019-12-27. This flaw stems from the library's failure to utilize the default, stronger algorithm for libsodium's crypto_pwhash_str function. With a CVSS score of 7.5 (High), this vulnerability allows an unauthenticated attacker to potentially compromise user credentials with low attack complexity, leading to high confidentiality impact. There is currently no evidence of active exploitation, publicly available exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this CVE.