The forced password-change flow in Pheditor (before version 2.0.8) does not verify that the submitted current password matches the stored password when the stored password is still the default ('admin'). Any non-empty value submitted as the current password allows access to the password-change form. Submitting new password fields in the same request sets a new admin password and authenticates the attacker without proof of knowledge of the original password. The root cause is a missing verification step comparing the submitted password hash to the stored password hash before entering the forced password-change logic. This flaw enables a complete authentication bypass on instances that have not changed the default password.

An unauthenticated attacker can fully bypass authentication on affected Pheditor instances that still use the default 'admin' password. The attacker can arbitrarily set a new admin password and obtain an authenticated session, gaining full administrative control. This vulnerability is critical as it allows complete compromise of the affected system without any prior credentials.

A fix is available in Pheditor version 2.0.8 and later. The vulnerability is remediated by verifying the submitted current password against the stored password hash before allowing the forced password-change flow. Users should upgrade to version 2.0.8 or later to address this issue. Until patched, do not leave the default password in use. Patch status is confirmed by the affectedVersions field indicating versions prior to 2.0.8 are vulnerable.