MantisBT: Authentication bypass for some passwords due to PHP type juggling

Vulnerability

Overview

CVE-2025-47776 is an authentication bypass vulnerability in Mantis Bug Tracker (MantisBT) versions 2.27.1 and earlier. The root cause is the use of loose (==) instead of strict (===) comparison in the authentication code authentication code [4]. This allows PHP type juggling to interpret certain MD5 hashes as numbers when they match scientific notation patterns (e.g., 0e...), causing them to evaluate to zero [1][3].

Exploitation

An attacker who knows a victim's username and has access to an account with a password hash that evaluates to zero can log in as that victim without knowing their actual password. The attacker simply uses any other password whose MD5 hash also evaluates to zero (e.g., comito5 or 5vIibvvE) [3]. No brute-forcing is required; the attacker only needs to guess or know the victim's username [3].

Impact

Successful exploitation allows an attacker to impersonate any user whose password produces a hash that evaluates to zero under scientific notation. This can lead to unauthorized access to sensitive bug tracker data, privilege escalation if the victim is an administrator, and further compromise of the MantisBT instance [1][3].

Mitigation

The vulnerability is fixed in MantisBT version 2.27.2 [1]. Users should upgrade immediately. No workaround is mentioned; the fix replaces loose comparison with strict comparison in the authentication logic [4].