{"action":"Upgrade pheditor/pheditor to 2.0.8 or later.","affected":[{"fixed":"2.0.8","introduced":"0"}],"component":"pheditor/pheditor","cve_ids":[],"ecosystem":"Packagist","exploited":false,"fixed_versions":["2.0.8"],"ghsa_id":"GHSA-f25v-x6vr-962g","id":"tcs_01M5KF1AXNHPMTA4NQ3YDR0WZT","modified_at":"2026-07-24T22:00:26.967609656Z","published_at":"2026-07-24T21:54:24Z","references":["https://osv.dev/vulnerability/GHSA-f25v-x6vr-962g","https://github.com/pheditor/pheditor/security/advisories/GHSA-f25v-x6vr-962g","https://github.com/pheditor/pheditor/commit/0978bcda644832b67357340e2f271e32d86fdf86","https://github.com/pheditor/pheditor","https://github.com/pheditor/pheditor/releases/tag/2.0.8"],"severity":{"label":"critical","score":10},"sources":[{"source":"osv","source_id":"GHSA-f25v-x6vr-962g","url":"https://osv.dev/vulnerability/GHSA-f25v-x6vr-962g"}],"summary":"Pheditor: Authentication Bypass in Forced Password-Change Flow via Unverified Current Password"}