CVE-2025-47776: MantisBT Authentication Bypass Vulnerability

CVE-2025-47776 Overview

CVE-2025-47776 is an authentication bypass vulnerability in Mantis Bug Tracker (MantisBT), an open source issue tracker. The flaw stems from incorrect use of loose comparison (==) instead of strict comparison (===) in the authentication code. Due to PHP type juggling behavior, certain MD5 hashes matching scientific notation are interpreted as numbers rather than strings. This allows attackers who know a victim's username and have access to an account with a password hash that evaluates to zero to log in without knowing the victim's actual password by using any other password with a hash that also evaluates to zero.

Critical Impact

Attackers can bypass authentication on MantisBT instances using the MD5 login method by exploiting PHP type juggling, potentially gaining unauthorized access to user accounts without valid credentials.

Affected Products

• MantisBT versions 2.27.1 and below
• MantisBT instances using MD5 login method
• Self-hosted MantisBT deployments with vulnerable authentication configurations

Discovery Timeline

• 2025-11-04 - CVE CVE-2025-47776 published to NVD
• 2025-11-10 - Last updated in NVD database

Technical Details for CVE-2025-47776

Vulnerability Analysis

This vulnerability represents a classic PHP type juggling weakness in the authentication mechanism of MantisBT. The core issue resides in core/authentication_api.php, where password comparison logic uses PHP's loose comparison operator (==) instead of the strict comparison operator (===).

In PHP, loose comparison performs type coercion before comparing values. When MD5 hashes begin with 0e followed by digits (matching scientific notation format), PHP interprets these strings as floating-point numbers with a value of zero. Consequently, if both the stored password hash and the attacker-supplied password hash evaluate to zero (e.g., both start with 0e followed only by digits), they will be considered equal despite being different strings.

This vulnerability is exploitable on MantisBT instances configured to use MD5 password hashing. An attacker must know the target username and either control an account with a zero-evaluating hash or find a password that produces such a hash.

Root Cause

The root cause is the use of PHP's loose comparison operator (==) in the password verification logic within core/authentication_api.php. The vulnerable code compares the result of auth_process_plain_password() with the stored password hash using loose comparison, allowing PHP's type juggling to treat scientifically-notated hash strings as numeric zeros.

Attack Vector

The attack is network-based and requires no privileges or user interaction. An attacker can exploit this vulnerability remotely by:

1. Identifying a MantisBT instance using MD5 authentication
2. Targeting a user account whose password hash begins with 0e followed by numeric digits
3. Submitting a password that also produces a 0e-prefixed hash (known as "magic hashes")
4. The loose comparison evaluates both hashes as 0 == 0, returning true and granting access

// Vulnerable code (before patch)
foreach( $t_login_methods as $t_login_method ) {
	# pass the stored password in as the salt
	if( auth_process_plain_password( $p_test_password, $t_password, $t_login_method ) == $t_password ) {
		# Do not support migration to PLAIN, since this would be a crazy thing to do.
		# Also if we do, then a user will be able to login by providing the MD5 value
		# that is copied from the database.  See #8467 for more details.

// Fixed code (after patch)
foreach( $t_login_methods as $t_login_method ) {
	# pass the stored password in as the salt
	if( auth_process_plain_password( $p_test_password, $t_password, $t_login_method ) === $t_password ) {
		# Do not support migration to PLAIN, since this would be a crazy thing to do.
		# Also if we do, then a user will be able to login by providing the MD5 value
		# that is copied from the database.  See #8467 for more details.

Source: GitHub Commit 966554a

Detection Methods for CVE-2025-47776

Indicators of Compromise

• Unusual successful login events for accounts with known vulnerable hash patterns
• Multiple login attempts from different IP addresses for the same user account
• Authentication logs showing successful logins without corresponding legitimate user activity
• Database records containing password hashes starting with 0e followed by numeric digits

Detection Strategies

• Implement web application firewall rules to monitor authentication endpoints for anomalous patterns
• Review MantisBT authentication logs for successful logins that don't correlate with expected user behavior
• Audit the MantisBT database for user accounts with password hashes matching the 0e[0-9]+ pattern
• Deploy intrusion detection signatures to identify PHP type juggling attack patterns

Monitoring Recommendations

• Enable verbose logging for MantisBT authentication events and forward to a centralized SIEM
• Monitor for brute-force attempts targeting multiple accounts with similar password inputs
• Set up alerts for successful authentications from unusual geographic locations or IP addresses
• Periodically audit user accounts for password hashes vulnerable to type juggling attacks

How to Mitigate CVE-2025-47776

Immediate Actions Required

• Upgrade MantisBT to version 2.27.2 or later immediately
• Review authentication logs for evidence of exploitation prior to patching
• Force password resets for any accounts with 0e-prefixed MD5 hashes
• Consider migrating from MD5 to a stronger password hashing algorithm

Patch Information

The vulnerability is fixed in MantisBT version 2.27.2. The fix changes the password comparison from loose (==) to strict (===) comparison in core/authentication_api.php. The security patch is available in commit 966554a19cf1bdbcfbfb3004766979faa748f9a2. Review the GitHub Security Advisory GHSA-4v8w-gg5j-ph37 for complete details.

Workarounds

• If immediate upgrade is not possible, manually apply the patch by changing == to === in the authentication comparison logic
• Disable MD5 login method and migrate to a more secure authentication mechanism
• Implement additional authentication controls such as multi-factor authentication
• Restrict network access to the MantisBT login endpoint to trusted IP ranges

# Configuration example
# Check your current MantisBT version
grep -r "MANTIS_VERSION" /path/to/mantisbt/core/constant_inc.php

# Verify the authentication file has been patched
grep -n "===" /path/to/mantisbt/core/authentication_api.php | grep auth_process_plain_password

# Force password resets for potentially vulnerable accounts (run in MantisBT database)
# SELECT user_id, username FROM mantis_user_table WHERE password REGEXP '^0e[0-9]+$';