Security Digest · Critical advisory (no CVE assigned)
GHSA-f25v-x6vr-962g: Pheditor: Authentication Bypass in Forced Password-Change Flow via Unverified Current Password
Summary The forced password-change flow, triggered when the stored password is still the default (admin), does not verify that the password submitted by the client actually matches the current password.
CVSS 10.0 Critical GitHub-reviewed · critical
Should you act?
- Only if you depend on one of the packages below, directly or transitively, in a vulnerable version. Check your lockfile with
composer audit. - No CVE has been assigned, so it will not appear in CVE-based scanners that ignore GitHub advisories.
npm audit,pip-auditand Dependabot do read GitHub advisories.
Affected packages
| Ecosystem | Package | Vulnerable | First fixed |
|---|---|---|---|
| Composer (PHP) | pheditor/pheditor | < 2.0.8 | 2.0.8 |
Details
Summary
The forced password-change flow, triggered when the stored password is still the default (admin), does not verify that the password submitted by the client actually matches the current password. Any non-empty value in pheditorpassword is enough to reach the password-change form, and submitting pheditornewpassword / pheditorconfirmpassword in the same request is enough to set an arbitrary new password and obtain an authenticated session — without ever proving knowledge of the current password.
Root Cause
pheditor.php line 163:
This checks whether the stored PASSWORD constant is still the default value. It does not check whether the submitted pheditorpassword matches it. As a result, on any instance that hasn't changed the default password, the check passes regardless of what the client actually sends, and the subsequent password-change branch is reachable without authentication.
PoC
Impact
On any instance where the default password has not yet been changed, an unauthenticated attacker can set an arbitrary new admin password and obtain a fully authenticated session, without knowing the current password. This is a complete authentication bypass, not merely "default credentials in use" — it holds even if the operator believes the instance is protected because the login form is present.
CVSS: 10.0 (v3.1) CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Sources and references
- GitHub Advisory GHSA-f25v-x6vr-962g github.com
- github.com github.com
- github.com github.com
- github.com github.com
Critical Composer (PHP) advisories · Today’s Security Digest