CVE-2026-54218

EUVD-2026-54449

07.08.2026, 10:16

Use of hard-coded cryptographic key vulnerability in Tobit Laboratories AG TeamDavid's Webbox. For users created locally in David, passwords are stored in various
files using only obfuscation. Any user with access to the server’s file
system, or who can otherwise extract files from the server (see
vulnerability “Random File Read”), can potentially obtain affected
users’ passwords. This issue affects TeamDavid through Rollout 524.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	UNKNOWN				---

Awaiting analysis

This vulnerability is currently awaiting analysis.

Base Score

CVSS 3.x

EPSS Score

Percentile: 37.55%

Common Weakness Enumeration

CWE-321 - Use of Hard-coded Cryptographic Key
The use of a hard-coded cryptographic key significantly increases the possibility that encrypted data may be recovered.

References

https://david.tobit.software/releasenotes

https://labs.infoguard.ch/posts/22-cves-in-david-a-secure-m365-alternative/