CVE-2026-35675 phpMyFAQ - Authentication Bypass via Missing Password Reset Token in /api/user/password/update
Unauthenticated attackers can bypass password reset verification to take over any user account, including administrators, in phpMyFAQ.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-35675?
CVE-2026-35675 is a high-severity authentication bypass vulnerability in thorsten phpMyFAQ, published on 28 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
phpMyFAQ before 4.1.3 contains an authentication bypass vulnerability in the password reset endpoint that allows unauthenticated attackers to reset any user account password without token verification or email confirmation. Attackers can enumerate valid usernames, obtain plaintext passwords via email, and achieve complete account takeover including administrative access.
Weakness: CWE-307
Which versions are affected by CVE-2026-35675?
4 open source packages ship an affected version, including thorsten/phpmyfaq and phpmyfaq/phpmyfaq.
| Package | Affected | Fixed in |
|---|---|---|
thorsten/phpmyfaq Packagist | All versions | 4.1.3 |
thorsten/phpmyfaq Packagist | All versions | 4.1.3 |
phpmyfaq/phpmyfaq Packagist | All versions | 4.1.3 |
phpmyfaq/phpmyfaq Packagist | All versions | 4.1.3 |
How do I fix CVE-2026-35675?
Upgrade thorsten/phpmyfaq to 4.1.3 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-35675 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-35675 exists.
Sources
Also known as GHSA-w9xh-5f39-vq89.