{"uuid": "f5b59fcf-e798-4666-a10b-a8bdffb63637", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-w9xh-5f39-vq89", "type": "seen", "source": "https://gist.github.com/alon710/5a6f8f892a6be8e022155f20b43547e4", "content": "# GHSA-W9XH-5F39-VQ89: GHSA-w9xh-5f39-vq89: Authentication Bypass and Account Takeover via Weak Password Recovery in phpMyFAQ\n\n> **CVSS Score:** 7.1\n> **Published:** 2026-05-20\n> **Full Report:** https://cvereports.com/reports/GHSA-W9XH-5F39-VQ89\n\n## Summary\nphpMyFAQ versions prior to 4.1.3 contain a critical authentication bypass and account takeover vulnerability due to a flawed password recovery mechanism. The application processes password reset requests without requiring cryptographic token verification, allowing unauthenticated attackers to arbitrarily change passwords and lock out legitimate users.\n\n## TL;DR\nA vulnerability in the phpMyFAQ `/api/user/password/update` endpoint allows unauthenticated attackers to reset user passwords by supplying a valid username and email address. This lack of token verification leads to account lockouts and potential full account takeover.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CVSS Score**: 7.1 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N)\n- **CWE ID**: CWE-640 (Weak Password Recovery Mechanism), CWE-288\n- **Attack Vector**: Network\n- **Authentication Required**: None\n- **Exploit Status**: Proof of Concept available\n- **Affected Component**: UnauthorizedUserController::updatePassword()\n\n## Affected Systems\n\n- phpMyFAQ (< 4.1.3)\n- **phpMyFAQ**: < 4.1.3 (Fixed in: `4.1.3`)\n\n## Mitigation\n\n- Upgrade phpMyFAQ to version 4.1.3 or higher.\n- Implement WAF rules to block unauthenticated HTTP PUT requests to the `/api/user/password/update` API endpoint.\n- Apply rate limiting on authentication and password reset endpoints to prevent enumeration.\n\n**Remediation Steps:**\n1. Verify the current running version of phpMyFAQ.\n2. If the version is prior to 4.1.3, schedule an immediate maintenance window.\n3. Download the latest release from the official phpMyFAQ repository.\n4. Apply the update following vendor documentation.\n5. Review application logs for indicators of compromise prior to the update.\n\n## References\n\n- [GitHub Security Advisory: GHSA-w9xh-5f39-vq89](https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-w9xh-5f39-vq89)\n- [phpMyFAQ Source Code Repository](https://github.com/thorsten/phpMyFAQ)\n- [OSV Vulnerability Record](https://osv.dev/vulnerability/GHSA-w9xh-5f39-vq89)\n- [phpMyFAQ Official Changelog](https://www.phpmyfaq.de/changelog/)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-W9XH-5F39-VQ89) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-05-20T18:40:49.000000Z"}