CVE-2006-0868: PEAR::Auth potential authentication bypass vulnerability

high Affects pear/auth. Feed 2026.10.29.1, updated 2026-10-28; published 2022-05-01; advisory modified 2024-12-05.

PEAR::Auth potential authentication bypass vulnerability

Package: pear/auth Composer
Affected versions: <1.2.4 or >=1.3.0r1 and <1.3.0r4
Fixed in: 1.2.4, 1.3.0r4
Severity: high
Exploitation: not on CISA KEV · EPSS 3% (84.7th percentile)
Published: 2022-05-01
Source: osv.dev

References

Am I affected?

Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# one-time install
pip install phpwarden

# then
phpwarden deps composer.lock

Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command

Install docs How findings are ranked

Related advisories

CVE-2006-2667 high Direct static code injection vulnerability in WordPress 2.0.2 and earlier allows remote at also from 2006
CVE-2006-5031 medium CakePHP directory traversal vulnerability allows remote attackers to read arbitrary files also from 2006
CVE-2006-6808 medium Cross-site scripting (XSS) vulnerability in wp-admin/templates.php in WordPress 2.0.5 allo also from 2006
CVE-2006-3360 medium phpSysInfo allows remote attackers to determine the existence of arbitrary files via a .. also from 2006
CVE-2006-0733 low Cross-site scripting (XSS) vulnerability in WordPress 2.0.0 allows remote attackers to inj also from 2006
CVE-2006-4028 high Multiple unspecified vulnerabilities in WordPress before 2.0.4 have unknown impact and rem also from 2006