Critical · published November 5, 2025
⚡ A sneaky comparison flaw in Mantis Bug Tracker could let attackers log in as victims with a simple password swap! 🔄 Think of it like a restaurant that mistakenly allows anyone to order a dish if they can match a zero-cost meal — an oversight that turns one dining experience into a free-for-all. 🍽️ An attacker could easily log in as any user who has a username and an MD5 hash evaluating to zero, completely bypassing the actual password. This means sensitive data could be exposed or tampered with, putting your projects at risk. It's a dangerous scenario that could lead to unauthorized access and manipulation of critical issue tracking information.
Think of it like a restaurant that mistakenly allows anyone to order a dish if they can match a zero-cost meal — an oversight that turns one dining experience into a free-for-all. 🍽️ This vulnerability arises from using loose (==) instead of strict (===) comparison in the authentication process, which allows PHP's type juggling to interpret certain MD5 hashes as numbers. As a result, if an attacker knows a username and has access to a zero-value hash, they can gain unauthorized access without needing the correct password.
An attacker could easily log in as any user who has a username and an MD5 hash evaluating to zero, completely bypassing the actual password. This means sensitive data could be exposed or tampered with, putting your projects at risk. It's a dangerous scenario that could lead to unauthorized access and manipulation of critical issue tracking information. Immediate action is required! Upgrade Mantis Bug Tracker to version 2.27.2 to eliminate this vulnerability. Additionally, review any accounts that may have been affected and consider implementing stronger password policies to add an extra layer of security. You've got this! Follow these steps and you’ll be back on track, securing your MantisBT in no time. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| mantisbt/mantisbt | < 2.27.2 | 2.27.2 |