CVE-2026-30849 SOAP API Authentication Bypass via Type Juggling

CVE-2026-30849 is a critical-severity vulnerability. AttackerView checks MantisBT sites for it with a live exploit check.

Is my site vulnerable to CVE-2026-30849?

Detects MantisBT instances running on MySQL where the SOAP API's mc_login function accepts passwords as integers instead of strings. By sending the password as xsd:integer 0, MySQL's implicit type conversion causes the stored password hash to compare equal to 0, bypassing authentication entirely. An attacker who knows any username gains full API access. All versions before 2.28.1 on MySQL backends are affected.