dbcve.org
Improper AuthenticationWeakness · CWE-287

CVE-2025-15586

CRITICAL · 10.0 CVSS v4.0 Published 2026-02-19
Patch available
A vendor patch is available. No clean upgrade release — apply the published patch.
See remediation →
100/100
Remediation priority · Urgent
Remotely reachable No privileges Zero-click Patch available

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
OGP-Website installs prior git commit 52f865a4fba763594453068acf8fa9e3fc38d663 are affected by a type juggling flaw which if exploited can result in authentication bypass without knowledge of the victim account's password.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

OGP-Website versions prior to git commit 52f865a4fba763594453068acf8fa9e3fc38d663 contain a type juggling vulnerability in their authentication mechanism. This flaw allows attackers to bypass password verification by exploiting PHP's loose type comparison (e.g., comparing '0' == 'password' evaluates to true), enabling unauthorized access to user accounts without knowing the actual password.

MitigationUpgrade OGP-Website to commit 52f865a4fba763594453068acf8fa9e3fc38d663 or later, which should contain the fix for the type juggling issue in the authentication logic.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
None
Authentication
X
User interaction
None
Scope
X

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Identify the installed OGP-Website version
    Locate the git repository for your OGP-Website installation and run 'git log -1 --format=%H' to obtain the current commit hash, or check any version file if the application stores version information
    Affected if The commit hash precedes 52f865a4fba763594453068acf8fa9e3fc38d663 (i.e., your version is older than the fix commit)
  2. Locate the authentication logic
    Search the codebase for files handling user login, password verification, or session authentication. Common locations include files with 'auth', 'login', or 'user' in their names within the application root or source directories
    Affected if The authentication file exists and is from a version before the fix commit
  3. Examine password comparison code
    Open the authentication file and search for password comparison operators, specifically looking for '==' (loose comparison) used against user-provided password variables, rather than '===' (strict comparison)
    Affected if The code uses == for password comparison rather than ===, which enables type juggling attacks
  4. Verify PHP type juggling vulnerability
    Inspect the password verification logic to confirm it compares a user-input password directly using loose comparison operators. Look for patterns like 'if ($password == $stored_hash)' or similar where user input is compared without strict type checking
    Affected if The code performs loose type comparison ('==') on password input, allowing strings like '0' to bypass verification when compared against certain hash values

You are affected if your OGP-Website installation is at a commit earlier than 52f865a4fba763594453068acf8fa9e3fc38d663 AND the authentication code uses loose type comparison (==) for password verification.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Patch available Apply the vendor patch
Vendor patch github.com →
Interim mitigation

Upgrade OGP-Website to commit 52f865a4fba763594453068acf8fa9e3fc38d663 or later, which should contain the fix for the type juggling issue in the authentication logic.

Recommended fix Moderate confidence

git commit 52f865a4fba763594453068acf8fa9e3fc38d663 (or latest version containing this fix)

  1. Identify the currently installed OGP-Website version by checking the git commit hash or version file
  2. Backup the current OGP-Website installation and database before making changes
  3. Navigate to the OGP-Website directory in your terminal
  4. Fetch the latest changes from the remote repository: git fetch origin
  5. Checkout or pull the fixed commit: git checkout 52f865a4fba763594453068acf8fa9e3fc38d663 or git pull origin <branch> 52f865a4fba763594453068acf8fa9e3fc38d663
  6. Verify the fix was applied by confirming the current HEAD matches the fixed commit: git log -1 --oneline
  7. Clear any application caches if applicable
  8. Test authentication functionality to confirm the type juggling vulnerability is remediated
Caveat Verify custom modifications to authentication code do not conflict with the fix; type comparison changes may affect custom auth logic

Generated from the published advisory — verify against the referenced sources before acting.

Have this fixed Scoped from the published advisory
  • Consultation2.0 h
  • Implementation1.0 h
  • Testing4.0 h
  • Review / QA2.0 h
9.0 hours of engineering $1,540
Get the patch applied

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $2,464.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2025-15586 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2025-15586 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data