Skip to content
Threat Feed
Subscribe

Product

Pheditor (< 2.0.8)

1 brief RSS
critical advisory

Pheditor Authentication Bypass via Unverified Current Password in Forced Password Change

A critical authentication bypass vulnerability in Pheditor versions prior to 2.0.8 allows an unauthenticated attacker to gain full administrative access by exploiting a flaw in the forced password-change flow, enabling them to set an arbitrary new admin password and obtain an authenticated session without knowing the current one.

pheditor authentication-bypass web-application ghsa network
3t