CVE-2026-25889
Case-Sensitivity Bypass in File Browser Password Validation Enables Account Takeover
Publication date: 2026-02-09
Last updated on: 2026-02-23
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| filebrowser | filebrowser | to 2.57.1 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-178 | The product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in File Browser versions prior to 2.57.1 and involves a case-sensitivity flaw in the password validation logic.
Specifically, by using the field name "Password" with a capital 'P' instead of the lowercase "password" in an API request, the system bypasses the verification of the current password.
This means that any authenticated user can change their password without providing the current password, and an admin can change any user's password without the current password.
An attacker who obtains a valid JWT token through methods like cross-site scripting (XSS) or session hijacking can exploit this flaw to take over accounts.
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized account takeover.
If an attacker gains access to a valid JWT token, they can change passwords without knowing the current password, potentially locking out legitimate users.
This compromises the integrity and security of user accounts, leading to potential unauthorized access to sensitive files managed by the File Browser.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade File Browser to version 2.57.1 or later, where the password validation logic flaw has been fixed.
Additionally, ensure that JWT tokens are protected from theft via XSS, session hijacking, or other means to prevent account takeover.