GHSA-gp95-j463-vv28
High · 7.5phpMyFAQ: Default Empty API Token Authentication Bypass
CVSS
7.5
EPSS
—
Published
May 20, 2026
CISA due date
—
The record
A default empty API client token allows any unauthenticated user to create and modify FAQ entries, categories, and questions via the REST API. The vulnerability exists in all versions since API v4.0 was introduced because the installation process seeds `api.apiClientToken` with an empty string, and the `hasValidToken()` comparison logic cannot distinguish between "no token configured" and "attacker sent a matching empty token header."
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-35672 phpMyFAQ before 4.1.3 contains an authentication bypass vulnerability in API v4.0 where… Same vulnerability
- CVE-2026-38739 ezsystems/ezpublish-legacy has a SQL injection in dfscleanup CWE-937
- CVE-2026-47121 Sparkle: Binary delta apply intermediate-symlink traversal in malicious .delta CWE-937
- CVE-2026-47255 AgenticMail API/storage and outbound relay hardening fixes CWE-937
- CVE-2026-47122 Sparkle's AppInstaller post-stage-1 XPC listener accepts unvalidated connections… CWE-937
- CVE-2026-47695 CC-Tweaked has an SSRF Protection Bypass with NAT64 CWE-937
- GHSA-7cwm-fpfh-rrch Ironic Standalone Operator's prometheus metrics exporter bound to all interfaces CWE-937
- GHSA-hfc8-w5f4-3x6m Ironic Standalone Operator's controller modifies user-owned resources without consent CWE-937