# CVE-2026-105703: PHPGurukul User Registration System broken authentication in change password

Source: https://junglewise.ai/threats/cve-2026-105703-a-vulnerability-was-determined-in-phpgurukul-user-registration  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-06. Updated: 2026-10-06  
License: CC BY 4.0 with a link back

CVE-2026-105703 · Severity: medium · CVSS 4.7 · Published 2026-10-06

PHPGurukul's User Registration & Login System is a PHP-based admin panel used to manage user accounts. An attacker with access to any admin account can change another admin's password by using a valid password from anywhere in the admin database, bypassing the re-authentication check that should prevent unauthorized password changes. This allows an attacker to take persistent control of a hijacked admin session or account.

Vendors: [Phpgurukul](https://junglewise.ai/threats/vendors/phpgurukul).

## Quick answers

**Is CVE-2026-105703 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-105703 being exploited in the wild.

**How severe is CVE-2026-105703?** Medium severity, with a CVSS score of 4.7, published 6 October 2026.

**Which products and versions are affected?** Phpgurukul User Registration & Login and User Management System 3.3.

**Is there a fix for CVE-2026-105703?** No fixed version is recorded yet. Bind the current password validation to the authenticated admin's session ID and account ID, ensuring the SELECT query includes a WHERE clause matching both the id from the session and the provided password hash. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-105703 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-105703?** Check whether you run Phpgurukul User Registration & Login and User Management System at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Bind the current password validation to the authenticated admin's session ID and account ID, ensuring the SELECT query includes a WHERE clause matching both the id from the session and the provided password hash.

## Technical details

The vulnerability is a broken access control flaw (CWE-863) in the change password endpoint (loginsystem/admin/change-password.php). The password validation query checks if the supplied currentpassword matches any admin record without constraining the check to the authenticated user's session ID, allowing an attacker to bypass re-authentication by supplying any valid admin password. An authenticated attacker (with a valid admin session) can exploit this over the network to change any admin account's password by knowing any other admin's password.

## Affected products

- PHPGurukul User Registration & Login and User Management System 3.3

## Timeline

- 2026-10-06: disclosed

## References

- [https://github.com/CyberShailendra1/phpgurukul-change-password-broken-auth](https://github.com/CyberShailendra1/phpgurukul-change-password-broken-auth)
- [https://phpgurukul.com/](https://phpgurukul.com/)

## Related threats

- [PHPGurukul User Management System SQL injection in yesterday-reg-users.php](https://junglewise.ai/threats/cve-2026-5543-phpgurukul-user-management-system-sql-injection-in-yesterday-reg)