CVE-2025-67719: Ibexa User Bundle is missing password change validation

critical Affects ibexa/user. Feed 2026.10.29.1, updated 2026-10-28; published 2025-12-10; advisory modified 2025-12-11.

Ibexa User Bundle is missing password change validation

Package: ibexa/user Composer
Affected versions: >=5.0.0-beta1 and <5.0.4
Fixed in: 5.0.4
Severity: critical
Exploitation: not on CISA KEV · EPSS 0% (3.4th percentile)
Published: 2025-12-10
Source: osv.dev

References

CWE-620

NVD record ibexa/user advisories

Am I affected?

Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.

# one-time install
pip install phpwarden

# then
phpwarden deps composer.lock

Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command

Install docs How findings are ranked

Related advisories

GHSA-r3fg-3r88-6x3f medium Ibexa User Settings are accessible on the front-end for anonymous user same package: ibexa/user
GHSA-q3x8-6898-23g3 medium ibexa/user login enumerates user accounts same package: ibexa/user
CVE-2024-34077 high Mantis Bug Tracker (MantisBT) allows user account takeover in the signup/reset password pr same weakness: CWE-620
CVE-2023-2297 critical The Profile Builder – User Profile & User Registration Forms plugin for WordPress is vulne same weakness: CWE-620
CVE-2023-4214 high The AppPresser plugin for WordPress is vulnerable to unauthorized password resets in versi same weakness: CWE-620
CVE-2023-2449 critical The UserPro plugin for WordPress is vulnerable to unauthorized password resets in versions same weakness: CWE-620