CVE-2026-54218

UNKNOWN 0.0

TeamDavid: Weak Cryptography and Insecure Password Storage

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

Use of hard-coded cryptographic key vulnerability in Tobit Laboratories AG TeamDavid's Webbox. For users created locally in David, passwords are stored in various files using only obfuscation. Any user with access to the server’s file system, or who can otherwise extract files from the server (see vulnerability “Random File Read”), can potentially obtain affected users’ passwords. This issue affects TeamDavid through Rollout 524.

CWE	CWE-321
Vendor	tobit laboratories ag
Product	teamdavid
Published	Aug 7, 2026
Last Updated	Aug 7, 2026

Stay Ahead of the Next One

Get instant alerts for tobit laboratories ag teamdavid

Be the first to know when new unknown vulnerabilities affecting tobit laboratories ag teamdavid are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

Tobit Laboratories AG / TeamDavid

0 ≤ Rollout 524

References

NVD ↗ CVE.org ↗ EPSS Data ↗

david.tobit.software: https://david.tobit.software/releasenotes labs.infoguard.ch: https://labs.infoguard.ch/posts/22-cves-in-david-a-secure-m365-alternative/

Credits

Lucas Dodgson of InfoGuard Labs