Critical · published August 19, 2025
🔥 A crafty comparison flaw in Plesk Obsidian 18.0.70 could let attackers waltz right into the admin panel with a password that evaluates to zero! Think of it like a restaurant that serves anyone who orders the same price meal even if they don’t have the correct cash — a shady loophole letting in anyone with the right coded cash string while ignoring the rules! This means an attacker could log in as an admin without knowing the actual password. They could potentially make changes, access sensitive data, or even bring the whole system down. The consequences could be absolutely devastating!
Think of it like a restaurant that serves anyone who orders the same price meal even if they don’t have the correct cash — a shady loophole letting in anyone with the right coded cash string while ignoring the rules! In Plesk Obsidian, the function _isAdminPasswordValid uses a flawed comparison method, allowing strings that evaluate to '0' (like '0e0') to bypass authentication checks if the correct password starts with '0e'.
This means an attacker could log in as an admin without knowing the actual password. They could potentially make changes, access sensitive data, or even bring the whole system down. The consequences could be absolutely devastating! Update to the latest version of Plesk Obsidian immediately to patch this vulnerability. Review your access controls and ensure that strong password policies are enforced to mitigate unauthorized access risks. You've got this! With a quick update and some vigilance, you can keep your system secure! 🛡️