Authentication Bypass when using using older password hashes

An attacker can bypass authentication by supplying a password whose MD5 hash starts with `0e` followed by digits (a "magic hash"). PHP's loose comparison (`==`) interprets both the computed hash and the stored hash as numeric zero when they both match the `0e...` pattern, causing the comparison to return `true` regardless of the actual password [ref_id=1]. The attacker only needs network access to the Cacti login page and a stored password hash that also begins with `0e` (e.g., the default `admin` or `guest` accounts) [ref_id=1]. No valid credentials are required.

The vulnerable function is `compat_password_verify` in Cacti's authentication code [ref_id=1]. The critical line is `return ($md5 == $hash);` where the MD5 hash of user-supplied input is loosely compared against the stored password hash from the database [ref_id=1].

Version 1.2.27 patches the issue by changing the loose comparison `$md5 == $hash` to a strict comparison `$md5 === $hash` in `compat_password_verify` [ref_id=1]. This prevents PHP type juggling because strict comparison checks both value and type, so a string hash starting with `0e` will not be treated as numeric zero. The patch also ensures that `password_verify` (which uses bcrypt/argon2) is preferred when available, falling back to MD5 only on PHP < 5.5.0, but even in that fallback path the strict comparison closes the magic-hash bypass.

An attacker can log in as `admin` by entering the password `240610708` (whose MD5 hash is `0e462097431906509019562988736854`) because the stored admin password hash `0e052539892259114859640052326948` also starts with `0e`, and PHP's loose comparison treats both as zero [ref_id=1].