[SECURITY] User passwords hashed with MD5 or without proper salting - vulnerable to rainbow table attacks

[anshul23102]

Description

The user model or authentication service hashes passwords using md5(password) or a similarly weak function without a unique per-user salt. MD5 is a fast hashing algorithm designed for data integrity, not password storage. Pre-computed rainbow tables can reverse most common passwords in seconds.

Steps to Reproduce

1. Register a user with password Password123.
2. Access the database directly and read the stored hash.
3. Paste the hash into any online MD5 reverse lookup tool.
4. Observe Password123 is recovered instantly.

Root Cause

A cryptographically weak function is used for password hashing instead of a slow, salted algorithm like bcrypt, scrypt, or Argon2.

Impact

A database breach exposes all user passwords. Even "strong" passwords are at risk because MD5 can be computed at billions of hashes per second on commodity hardware.

Proposed Fix

const bcrypt = require("bcrypt");
const SALT_ROUNDS = 12;

// On registration:
const hash = await bcrypt.hash(plainPassword, SALT_ROUNDS);

// On login:
const match = await bcrypt.compare(plainPassword, storedHash);

Migrate existing hashes by prompting users to reset their passwords.

[anshul23102]

@Nsanjayboruds Hi! I came across this issue and I would love to work on it as part of GSSoC '26.

I have reviewed the problem description carefully and am confident I can deliver a well-tested, production-ready fix within the contribution timeline. Please let me know if you need any additional context or have specific implementation preferences before I get started.

Could you please assign this issue to me?

/assign
/claim

[aaniya22]

please assign this to me under gssoc'26