CVE-2025-47776 json
MantisBT: Authentication bypass for some passwords due to PHP type juggling
published 2025-11-03 12 mo ago modified 2026-10-19 21 d ago also EUVD-2025-37510 , GHSA-4v8w-gg5j-ph37
- cvss
- 9.1
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 28%
- public exploits
- 0
- none known
Summary
Mantis Bug Tracker (MantisBT) is an open source issue tracker. Due to incorrect use of loose (==) instead of strict (===) comparison in the authentication code in versions 2.27.1 and below.PHP type juggling will cause certain MD5 hashes matching scientific notation to be interpreted as numbers. Instances using the MD5 login method allow an attacker who knows the victim's username and has access to an account with a password hash that evaluates to zero to log in without knowing the victim's actual password, by using any other password with a hash that also evaluates to zero This issue is fixed in version 2.27.2.
Patch / fix
- packagist mantisbt/mantisbt 2.27.2
- mantisbt mantisbt 2.27.2
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 12 mo ago
Exploit prediction
0.34% chance of exploitation in the next 30 days, higher than 28% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 8.8 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N |
| GitHub | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
| CNA | 4.0 | 8.8 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 9.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | mantisbt/mantisbt | <2.27.2 |
2.27.2 |
Affected products
- mantisbt mantisbt
Classification
References
-
github.com
/mantisbt/mantisbt/commit/966554a19cf1bdbcfbfb3004766979faa748f9a2
web, patch
-
github.com
/mantisbt/mantisbt/security/advisories/GHSA-4v8w-gg5j-ph37
web, issue-tracking, mitigation, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2025-47776
advisory
-
github.com
/mantisbt/mantisbt
package
-
github.com
/mantisbt/mantisbt/blob/0fb502dd613991e892ed2224ac5ea3e40ba632bc/core/authentication_api.php#L782
web
-
mantisbt.org
/bugs/view.php?id=35967
web
Sources
- CVE List CVE-2025-47776
- GitHub Advisory GHSA-4v8w-gg5j-ph37
- NVD CVE-2025-47776
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.