Authentication Bypass in Code-Projects PHP Task Management System via Missing Password Validation

Vulnerability Overview Vulnerability Name: Authentication Bypass in Code-Projects Task Management System via Missing Password Validation #1 Affected Product: Task Management System in PHP with Source Code Vendor: Code-Projects Vendor Homepage: https://code-projects.org/task-management-system-in-php-with-source-code/ Affected Version: The package downloadable on June 21, 2026 Vulnerability Type: CWE-287: Improper Authentication CWE-305: Authentication Bypass by Primary Weakness Vulnerable File: Root Cause: The user login handler accepts an email address and password, but the database query only validates the provided email address and account status, failing to compare the submitted password. Consequently, an attacker can log in as any active user using any arbitrary password. Impact Scope A remote unauthenticated attacker who knows or guesses the email address of an active user can log in using any arbitrary password. The attacker gains access to the victim's authenticated session and can view the victim's profile, tasks, comments, and other authenticated features. Remediation 1. Store passwords using . 2. Retrieve the account using prepared statements based on email and status. 3. Verify the submitted password using . 4. Reject authentication if password verification fails. 5. Regenerate the session ID only after successful password verification. 6. Add login rate limiting and authentication failure logging. Example Code: Proof of Concept (POC) Test Account: Email: priyanka@gmail.com Stored Password: 123 Request Example: Server Response: The generated session ID can be used to access the authenticated user's homepage: Response displays the authenticated account: Test Environment Attacker: macOS 10.5 ARM64 with Yakit Target: Windows 64-bit with Apache 2.4.58 and PHP 8.2.12 Protocol: HTTP Attack Type: Remote and Unauthenticated Test Date: June 21, 2026

Goal Reached Thanks to every supporter — we hit 100%!

Authentication Bypass in Code-Projects PHP Task Management System via Missing Password Validation

More from this source