What’s Vulnerable › Vulnerabilities

CVE-2026-22205: SPIP < 4.4.10 Authentication Bypass via PHP Type Juggling

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-02-26 · updated 2026-06-17
• Weakness: CWE-288

Description

SPIP versions prior to 4.4.10 contain an authentication bypass vulnerability caused by PHP type juggling that allows unauthenticated attackers to access protected information. Attackers can exploit loose type comparisons in authentication logic to bypass login verification and retrieve sensitive internal data.

Affected products

• SPIP: before 4.4.10 — fixed in 4.4.10

How to fix

Upgrade to a fixed version: SPIP 4.4.10. Check the vendor advisory for mitigations.

References

• https://blog.spip.net/Mise-a-jour-de-securite-sortie-de-SPIP-4-4-10.html
• https://git.spip.net/spip/spip
• https://www.vulncheck.com/advisories/spip-sql-injection-rce-via-union-php-tags

Get alerted when CVE-2026-22205 or the next vulnerability affects your stack