Listen to this Post
The vulnerability is in the password change dialog in the Ibexa back office. During the transition from version 4 to version 5, a mistake was made in the validation code. This error caused the validation of the previous password to not execute as intended. Specifically, the system fails to check if the user provides the correct current password when requesting a password change. As a result, any authenticated user can change their password without knowing the previous one. This flaw allows an attacker with physical access to an unlocked workstation where a user is logged in to change the password and take over the account. The issue stems from a conditional bypass in the validation logic, where the code skips the password verification step. This missing validation occurs in the back office interface, making it a critical security gap for administrative accounts. The vulnerability exploits the lack of re-authentication during password updates, leading to unauthorized access.
Platform: Ibexa User Bundle
Version: v4 and v5
Vulnerability: Missing password validation
Severity: Critical
date: Dec 10 2025
Prediction: Patch TBA
What Undercode Say:
Analytics:
Bash commands:
`composer show ibexa/user`
`grep -r validation src/`
Codes:
if (!$oldPasswordValid) {
// Missing validation code
}
how Exploit:
Access unlocked workstation.
Change password without old.
Submit dialog request.
Protection from this CVE:
Apply patch update.
Enforce session timeouts.
Monitor account changes.
Impact:
Account takeover risk.
Unauthorized access possible.
Data integrity compromised.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
