CVE-2025-47776

Mantis Bug Tracker (MantisBT) is an open source issue tracker. Due to incorrect use of loose (==) instead of strict (===) comparison in the authentication code in versions 2.27.1 and below.PHP type juggling will cause certain MD5 hashes matching scientific notation to be interpreted as numbers. Instances using the MD5 login method allow an attacker who knows the victim's username and has access to an account with a password hash that evaluates to zero to log in without knowing the victim's actual password, by using any other password with a hash that also evaluates to zero This issue is fixed in version 2.27.2.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

Vector :

Exploitability : 3.9 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/mantisbt/mantisbt/commit/966554a19cf1bdbcfbfb3004766979faa748f9a2	Patch
https://github.com/mantisbt/mantisbt/security/advisories/GHSA-4v8w-gg5j-ph37	Issue Tracking Mitigation Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:mantisbt:mantisbt:*:*:*:*:*:*:*:*

History

19 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) Mantis Bug Tracker (MantisBT) es un rastreador de problemas de código abierto. Debido al uso incorrecto de la comparación laxa (==) en lugar de la estricta (===) en el código de autenticación en las versiones 2.27.1 e inferiores. La manipulación de tipos de PHP (PHP type juggling) hará que ciertos hashes MD5 que coinciden con la notación científica sean interpretados como números. Las instancias que utilizan el método de inicio de sesión MD5 permiten a un atacante que conoce el nombre de usuario de la víctima y tiene acceso a una cuenta con un hash de contraseña que se evalúa a cero iniciar sesión sin conocer la contraseña real de la víctima, utilizando cualquier otra contraseña con un hash que también se evalúe a cero. Este problema se corrige en la versión 2.27.2.

Information

Published : 2025-11-04 21:15

Updated : 2026-10-19 13:10

NVD link : CVE-2025-47776

Mitre link : CVE-2025-47776

CVE.ORG link : CVE-2025-47776

JSON object : View

Products Affected

mantisbt

mantisbt

CWE

CWE-305

Authentication Bypass by Primary Weakness

{"id": "CVE-2025-47776", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-47776", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-04T20:41:52.816601Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.2, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.8, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "mantisbt", "product": "mantisbt", "versions": [{"status": "affected", "version": "< 2.27.2"}]}]}], "published": "2025-11-04T21:15:37.367", "references": [{"url": "https://github.com/mantisbt/mantisbt/commit/966554a19cf1bdbcfbfb3004766979faa748f9a2", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/mantisbt/mantisbt/security/advisories/GHSA-4v8w-gg5j-ph37", "tags": ["Issue Tracking", "Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-305"}]}], "descriptions": [{"lang": "en", "value": "Mantis Bug Tracker (MantisBT) is an open source issue tracker. Due to incorrect use of loose (==) instead of strict (===) comparison in the authentication code in versions 2.27.1 and below.PHP type juggling will cause certain MD5 hashes matching scientific notation to be interpreted as numbers. Instances using the MD5 login method allow an attacker who knows the victim's username and has access to an account with a password hash that evaluates to zero to log in without knowing the victim's actual password, by using any other password with a hash that also evaluates to zero This issue is fixed in version 2.27.2."}, {"lang": "es", "value": "Mantis Bug Tracker (MantisBT) es un rastreador de problemas de c\u00f3digo abierto. Debido al uso incorrecto de la comparaci\u00f3n laxa (==) en lugar de la estricta (===) en el c\u00f3digo de autenticaci\u00f3n en las versiones 2.27.1 e inferiores. La manipulaci\u00f3n de tipos de PHP (PHP type juggling) har\u00e1 que ciertos hashes MD5 que coinciden con la notaci\u00f3n cient\u00edfica sean interpretados como n\u00fameros. Las instancias que utilizan el m\u00e9todo de inicio de sesi\u00f3n MD5 permiten a un atacante que conoce el nombre de usuario de la v\u00edctima y tiene acceso a una cuenta con un hash de contrase\u00f1a que se eval\u00faa a cero iniciar sesi\u00f3n sin conocer la contrase\u00f1a real de la v\u00edctima, utilizando cualquier otra contrase\u00f1a con un hash que tambi\u00e9n se eval\u00fae a cero. Este problema se corrige en la versi\u00f3n 2.27.2."}], "lastModified": "2026-10-19T13:10:00.110", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mantisbt:mantisbt:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B49EF21D-F412-4C89-BFA8-9606F204E310", "versionEndExcluding": "2.27.2"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}