vBulletin 5 Authentication handler seems to be completely broken

[XFFA.IR Bot]

Re XF 2.2 - merging accounts who prevails ?

I don't have access to vBulletin 5 authentication data, but from looking at the code the handler sees to be completely broken:

PHP:

protected function getHandler()
{
    return new PasswordHash(\XF::config('passwordIterations'), false);
}

protected function createHash($password)
{
    return md5($password);
}

public function authenticate($userId, $password)
{
    if (!is_string($password) ||...

Read more