CVE-2025-67719: 
PHP vulnerability analysis and mitigation

CVE-2025-67719 is an unverified password change vulnerability in the Ibexa Digital Experience Platform (DXP) User Bundle that allows a logged-in user to change their account password without providing the current password. The flaw affects versions 5.0.0-beta1 through 5.0.3 of the ibexa/user Composer package and was introduced during the migration from v4 to v5. It was reported by Code-Rhapsodie via responsible disclosure, published on December 10, 2025, and patched in version 5.0.4. The CVSS v4 base score is 9.3 (Critical) per the GitHub Advisory Database, though Feedly's assessment rates it 8.5 (High) (Github Advisory, GHSA Advisory).

The root cause is classified as CWE-620 (Unverified Password Change): during the v4-to-v5 migration, a coding error in src/lib/Form/Data/UserPasswordChangeData.php caused the @UserAssert\UserPassword() annotation (which validates the current password) to be applied incorrectly alongside #[Assert\NotBlank], resulting in the current-password validator never executing. The fix (commit 9d485bf) wraps both constraints in a #[Assert\Sequentially([...])] block, ensuring the NotBlank check runs first and the UserPassword validator runs second. Exploitation requires only an active, authenticated browser session — no credentials or special privileges are needed beyond physical or remote access to an unlocked session (GHSA Advisory, Patch Commit).

An attacker with access to an unattended, authenticated back-office session can change the account password without knowing the original, effectively locking the legitimate user out of their own account (account takeover). This impacts both confidentiality and integrity of the affected user account and any content or data accessible through it within the Ibexa DXP back office. There is no direct availability impact to the platform itself, but the locked-out user loses access to their account until an administrator intervenes (Github Advisory, GHSA Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.013% (0.02% per GitHub Advisory), placing it in the 6th percentile for exploitation likelihood. Exploitation is constrained to scenarios where an attacker has physical or remote access to an active, authenticated back-office session (Github Advisory, Feedly).

1. Identify a target session: Locate an unattended workstation or remote desktop session where a user is logged into the Ibexa DXP back office (versions 5.0.0-beta1 through 5.0.3).
2. Access the back office: Navigate to the back-office password change dialog, typically found under the user profile or account settings section.
3. Submit password change without current password: Fill in the "new password" and "confirm new password" fields with an attacker-chosen value. Due to the broken validation, the "current password" field can be left blank or filled with any arbitrary value — the server-side validator will not enforce it.
4. Submit the form: The password change request is accepted by the server without verifying the original password, updating the account credentials.
5. Lock out the legitimate user: The legitimate user's password is now changed to the attacker's chosen value, preventing them from logging in and granting the attacker persistent access to the account (GHSA Advisory, Patch Commit).

• Logs: Back-office audit logs showing a password change event for a user account at an unexpected time (e.g., outside business hours or when the user was not actively working); absence of a corresponding login event immediately before the password change.
• Application Logs: HTTP POST requests to the Ibexa back-office password change endpoint (e.g., /user/change-password or equivalent) with a blank or arbitrary value in the oldPassword field.
• User Reports: Legitimate users reporting sudden inability to log in with their known credentials, indicating an unauthorized password change.
• Session Activity: Back-office session activity logs showing actions performed from a known user's session that the user did not initiate (GHSA Advisory).

Upgrade the ibexa/user Composer package to version 5.0.4 or later, which restores correct sequential validation of the current password before allowing a password change. No official workarounds are available for unpatched versions. As interim risk-reduction measures, organizations should enforce workstation lock policies, enable multi-factor authentication where supported, and educate users about leaving authenticated sessions unattended (GHSA Advisory, Github Advisory).

The vulnerability was responsibly disclosed by the French security firm Code-Rhapsodie, who are credited in the official advisory. Ibexa acknowledged the report and released a fix promptly. No significant broader media coverage or notable researcher commentary beyond the official advisory has been observed (GHSA Advisory).