EIP-2026-108988

This advisory describes an information disclosure vulnerability in Kemana Directory 1.5.6 where the 'kemana_admin_passwd' cookie stores SHA1 password hashes, potentially allowing MitM attackers to gain access to password information. The provided HTTP request demonstrates the presence of the vulnerable cookie.