ibexa/user

Ibexa User bundle

Latest v5.0.10

Packagist

88%

Total Score

healthy

Healthy release backed by active maintenance, regular releases, and an established organization.

Are you affected? Scan for Free

Health Score Breakdown

Workflow audit

All seven workflows were analyzed without untrusted checkouts or script injection, but all 11 action references are unpinned and a high-confidence medium-severity secrets-inherit finding was reported in reviewers.yaml.

Vulnerabilities

Title	Versions	Severity
AIKIDO-2025-10958 Pre-CVE Found by Aikido Intel before public disclosure or CVE publication. ibexa/user is vulnerable to Cross-site Scripting (XSS) in versions 4.6.0 - 4.6.25 and 5.0.0 - 5.0.3.	4.6.0 - 4.6.255.0.0 - 5.0.3	Medium
CVE-2025-67719 ibexa/user is vulnerable to Unverified Password Change in versions 5.0.0-beta1 - 5.0.4.	5.0.0-beta1 - 5.0.4	Critical

Package versions

Maintainers

No maintainer information available.

Direct Dependencies

Dependency	Last Release	Score
twig/twig Version ^3.0	—	—
ibexa/core Version ~5.0	—	—
symfony/form Version ^7.4	—	—
symfony/intl Version ^7.4	—	—
symfony/config Version ^7.4	—	—