Read the docs
TI-2025-30241 Aliases CVE-2025-47776GHSA-4v8w-gg5j-ph37

MantisBT: Authentication bypass for some passwords due to PHP type juggling

Priority MEDIUM 44CWE-305Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

Mantis Bug Tracker (MantisBT) is an open source issue tracker. Due to incorrect use of loose (==) instead of strict (===) comparison in the authentication code in versions 2.27.1 and below.PHP type juggling will cause certain MD5 hashes matching scientific notation to be interpreted as numbers. Instances using the MD5 login method allow an attacker who knows the victim's username and has access to an account with a password hash that evaluates to zero to log in without knowing the victim's actual password, by using any other password with a hash that also evaluates to zero This issue is fixed in version 2.27.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00345 28th percentileScored 2026-11-07
Fix Fixed mantisbt (mantisbt): 2.27.2mantisbt/mantisbt (Packagist): 2.27.2

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
mantisbtmantisbtbefore 2.27.22.27.2Patch availableCNA
—mantisbt/mantisbt (Packagist)before 2.27.22.27.2Patch availableGHSA-4v8w-gg5j-ph37
  • mantisbt Vendormantisbt Affected before 2.27.2 Fixed in 2.27.2 Patch available CNA
  • mantisbt/mantisbt (Packagist) Vendor— Affected before 2.27.2 Fixed in 2.27.2 Patch available GHSA-4v8w-gg5j-ph37

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:mantisbt:mantisbt:*:*:*:*:*:*:*:*before 2.27.2Vulnerablemantisbt
  • cpe:2.3:a:mantisbt:mantisbt:*:*:*:*:*:*:*:* Versions before 2.27.2 Vulnerable ·mantisbt

Remediation

  • Fix · CNA mantisbt (mantisbt) Fixed in 2.27.2
  • Fix · GHSA-4v8w-gg5j-ph37 mantisbt/mantisbt (Packagist) Fixed in 2.27.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-47776
  2. 2026-10-03 Alias added: GHSA-4v8w-gg5j-ph37

References

Patch 1

Advisory 2

Other 3

  • TI-2017-05251 MantisBT through 2.3.0 allows arbitrary password reset and unauthenticated admin access… CVSS 3.1HIGH 8.8
  • TI-2014-05966 The XmlImportExport plugin in MantisBT 1.2.17 and earlier allows remote attackers to… CVSS 2.0HIGH 7.5
  • TI-2025-38760 MantisBT unauthorized disclosure of private project column configuration CVSS 4.0MEDIUM 5.3
  • TI-2017-04981 A cross-site scripting (XSS) vulnerability in the MantisBT Configuration Report page… CVSS 3.0MEDIUM 4.8
  • TI-2019-11797 MantisBT before 1.3.20 and 2.22.1 allows Post Authentication Command Injection, leading to Remote Code Execution. CVSS 3.1HIGH 7.2
  • TI-2014-07063 The XML Import/Export plugin in MantisBT 1.2.x does not restrict access, which allows… CVSS 2.0MEDIUM 6.4
See all 121 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences