Description: ------------ strstr is used when looking for the password record of a particular user rather than a check that makes sure the user name is an exact match. As a result, you can be authenticated with a substring of your actual user name. In addition, if a users name is a substring of another user farther up in the password file, the will never be able to log in. Reproduce code: --------------- Case 1: 1) Add user 'billybob' to a password file 2) Authenticate 'billy' using the password for 'billybob' Case 2: 1) Add user 'billy' to the same password file use in case 1 but with a different password. 2) Try to log in as 'billy' The bug is in the _auth($file, $id) function inside /File/Passwd/Common.php.... while ($line = fgets($fh)) { ! if (strstr($line, $id)) { File_Passwd_Common::_close($fh); return trim($line); } } Should be: while ($line = fgets($fh)) { ! if (preg_match("/^$id:/", $line)) { File_Passwd_Common::_close($fh); return trim($line); } } Expected result: ---------------- Case 1: * You should not be able to log in as 'billy' Case 2: * You should be able to log in as 'billy' Actual result: -------------- use of strstr hides 'billy' record and allows for false logins.