-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| mantisbt/mantisbt | composer | < 2.27.2 | 2.27.2 |
Miggo AIRoot Cause AnalysisThe analysis of the provided security advisory and the associated patch commit clearly identifies the root cause of the vulnerability. The commit 966554a19cf1bdbcfbfb3004766979faa748f9a2 shows a single, targeted change in the core/authentication_api.php file. The diff explicitly replaces the loose comparison operator == with the strict comparison operator === inside the auth_does_password_match function. This function is responsible for verifying if a provided password matches the stored hash. The vulnerability description explains that this loose comparison leads to a type juggling issue with MD5 hashes that resemble scientific notation, allowing an authentication bypass. Therefore, the auth_does_password_match function is the precise location of the vulnerability, as it performs the flawed comparison that enables the exploit.