CVE-2026-35672: phpMyFAQ - Authentication Bypass via Empty API Token

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-05-28 · updated 2026-10-26
Weakness: CWE-1188

Description

phpMyFAQ before 4.1.3 contains an authentication bypass vulnerability in API v4.0 where the default empty api.apiClientToken allows unauthenticated users to create and modify FAQ entries. Attackers can send an empty x-pmf-token header to bypass token validation and inject malicious content via POST endpoints /api/v4.0/faq/create, /api/v4.0/category, and /api/v4.0/question.

Affected products

thorsten phpMyFAQ: before 4.1.3 — fixed in 4.1.3

How to fix

Upgrade to a fixed version: thorsten phpMyFAQ 4.1.3. Check the vendor advisory for mitigations.

References

https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-gp95-j463-vv28
https://www.vulncheck.com/advisories/phpmyfaq-authentication-bypass-via-empty-api-token
https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-gp95-j463-vv28

Get alerted when CVE-2026-35672 or the next vulnerability affects your stack