Email accounts not hashing password

in the [EmailAccount] table, the passwords for the email accounts is not being hashed, its a very big vulnerability, since no one besides the owner of the account should have access to any password whatsoever, and now anyone with access to the db can lookup the password, which is extremely vulnerable issue.

Thanks a lot! Agree. They should encrypted (not hashed). Please find this work item here

Andrei i see that 3.90 is still having this security vulnerability, and i see on git that this work item is on hold, any reason why?https://github.com/nopSolutions/nopCommerce/issues/345

Hi,

I wouldn't say that it's a security vulnerability. It's a recommendation to increase security because none of standard users have direct access to database. But of course, we'll start working on it once more important tasks are finished