Authentication Bypass in Plesk Obsidian by Plesk

CVE-2025-54336

What is CVE-2025-54336?

In Plesk Obsidian version 18.0.70, the _isAdminPasswordValid function is susceptible to an authentication bypass due to a flawed comparison mechanism. Specifically, if the valid password is represented as '0e' followed by any digit sequence, an attacker can exploit this vulnerability by using other strings that evaluate to 0.0 (such as '0e0') to gain unauthorized access. This issue arises specifically in the admin/plib/LoginManager.php file, compromising the integrity of the admin authentication process.

References