CVE-2025-47776: Critical Auth Bypass in MantisBT

CVE-2025-47776 is a critical authentication bypass (CVSS 9.1) in Mantis Bug Tracker 2.27.1 and earlier. PHP type juggling in the login code lets some MD5 password hashes compare as equal. Instances that use the MD5 login method should upgrade to 2.27.2.

What's affected

MantisBT 2.27.1 and below are affected, according to both the record and the GitHub security advisory. The advisory lists 2.27.2 as the patched version and the package as mantisbt/mantisbt on Composer.

Only instances configured to use the MD5 login method are exposed. And within those, only accounts whose stored password hash looks like a number in scientific notation that evaluates to zero are at risk. The advisory describes the pattern as a hash that starts with zeros, then the letter e, then digits.

The score in the record is 9.1. The GitHub advisory shows its own severity of High, 8.8 under CVSS v4, so you may see two numbers depending on where you look. Both agree on the fix.

The record does not mark it as exploited in the wild, and it is not in the CISA Known Exploited Vulnerabilities catalog.

How to check if you're exposed

First confirm your version. Read the version from your MantisBT installation. If you installed with Composer, you can check with:

composer show mantisbt/mantisbt

Then check the login method. In your configuration file, look for the setting that selects the password hashing method, and see whether it is MD5.

The advisory gives a workaround that doubles as a check: query the database for accounts whose password hash matches the risky pattern. For MySQL that looks like this:

SELECT username, email FROM mantis_user_table WHERE password REGEXP '^0+[Ee][0-9]+$';

Any rows returned are accounts that match the pattern in the advisory. Change those users' passwords.

What to do now

1. Upgrade MantisBT to 2.27.2 or later.
2. Run the advisory query against your database and list any accounts that match.
3. Force a password change for those accounts.
4. If you can, move off the MD5 login method to a stronger one supported by your version.
5. Review login logs for successful logins by the matched accounts that you cannot explain.
6. Check your backups and staging copies, since they may hold the same user table.

If you want a quick look at what your own projects pull in, the free in-browser dependency scan at https://gold.safeguard.sh/scan needs no setup. The Gold directory lets you look up other CVEs by id.

Why it matters

The record classifies this as CWE-305, authentication bypass by primary weakness. The cause is small. PHP has a loose comparison operator that converts strings that look like numbers into numbers before comparing them. A hash such as zero followed by an e and digits is read as a number in scientific notation, which equals zero. Two different hashes that both evaluate to zero then compare as equal.

The code should have used the strict comparison operator, which compares type and value. The advisory notes that the lockout setting for failed logins does not help here, because no guessing is needed. This is a good example of why code review should look at comparison operators in any security check.

Try it yourself

Click through it at your own pace, or open it full screen.

Quick check

Sources

• Gold page for CVE-2025-47776
• MantisBT GitHub security advisory
• Fix commit

Last reviewed: 18 October 2026.