7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-35672

CVE-2026-35672: phpMyFAQ: Default Empty API Token Authentication Bypass

Summary

A default empty API client token allows any unauthenticated user to create and modify FAQ entries, categories, and questions via the REST API. The vulnerability exists in all versions since API v4.0 was introduced because the installation process seeds api.apiClientToken with an empty string, and the hasValidToken() comparison logic cannot distinguish between "no token configured" and "attacker sent a matching empty token header."

Details

The root cause is in two files:

1. Installation default (src/phpMyFAQ/Setup/Installation/DefaultDataSeeder.php, line 277-278):

'api.enableAccess'   => 'true',
'api.apiClientToken' => '',       // ← defaults to empty string

2. Authentication check (src/phpMyFAQ/Controller/AbstractController.php, line 198-204):

protected function hasValidToken(): void
{
    $request = Request::createFromGlobals();
    if ($this->configuration->get('api.apiClientToken') !== $request->headers->get('x-pmf-token')) {
        throw new UnauthorizedHttpException('"x-pmf-token" is not valid.');
    }
}

The method uses strict inequality (!==). When api.apiClientToken is '' (default) and the attacker sends x-pmf-token: (empty header value), the comparison becomes '' !== '' which evaluates to false — no exception is thrown, and authentication is completely bypassed.

The OpenAPI annotations confirm the developer intended these endpoints to require authentication: write endpoints are tagged 'Endpoints with Authentication' and document HTTP 401 responses, while read-only endpoints are tagged 'Public Endpoints'.

The following API endpoints call $this->hasValidToken() as their only authentication check:

| File | Endpoint | Method | | ------------------------------------------------------- | ---------------------- | ------ | | | | | | | | | | | | | | | | |

Miggo Vulnerability Database

→

CVE-2026-35672

CVE-2026-35672:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
thorsten/phpmyfaq	composer	<= 4.1.2	4.1.3
phpmyfaq/phpmyfaq	composer	<= 4.1.2	4.1.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The root cause of the vulnerability is an authentication bypass in the phpMyFAQ\Controller\AbstractController::hasValidToken function. This function is responsible for validating the API token for several write-access API endpoints. The vulnerability is triggered because the application, by default, initializes the API token (api.apiClientToken) to an empty string during installation. The hasValidToken function used a strict inequality comparison (!==). When an attacker sends a request with an empty x-pmf-token header to a vulnerable endpoint, the check becomes '' !== '', which evaluates to false, thereby incorrectly validating the request and bypassing authentication. This allows an unauthenticated attacker to create and modify content such as FAQs, categories, and questions.

The patch addresses this in three key places:

AbstractController.php: The hasValidToken function is modified to first check if the configured token is empty and reject the request if so. It also replaces the weak comparison with the constant-time hash_equals function to prevent timing attacks.
Installer.php: The installation logic is changed in startInstall to generate a cryptographically secure random token, ensuring new installations are not vulnerable by default.
Update.php: A new update step, applyUpdates413, is added to check for and replace empty tokens in existing installations, remediating systems that are already deployed with the insecure default.

Vulnerable functions

phpMyFAQ\Controller\AbstractController::hasValidToken

src/phpMyFAQ/Controller/AbstractController.php

The vulnerability lies in the original implementation of the `hasValidToken` function. It used a strict inequality check (`!==`) to compare the configured API token with the one provided in the 'x-pmf-token' header. Due to a separate issue in the installation process (fixed in the same patch), the default API token is an empty string. An attacker can send a request with an empty 'x-pmf-token' header. The comparison `'' !== ''` evaluates to `false`, causing the authentication check to be bypassed entirely. The patch fixes this by first checking if the configured token is empty and, if not, using the constant-time `hash_equals` function for comparison.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.

7.5

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-35672: phpMyFAQ: Default Empty API Token Authentication Bypass

Summary

Details

CVE-2026-35672:

7.5

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Detect and Respond To Threats Faster.

Basic Information

Basic Information

Technical Details

7.5

7.5

CVE-2026-35672: phpMyFAQ: Default Empty API Token Authentication Bypass

Summary

Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

Vulnerable functions

PoC

Impact

7.5

-

Basic Information

Basic Information

Concerned about an active attack path?

CVE-2026-35672: phpMyFAQ: Default Empty API Token Authentication Bypass

Summary

Details

CVE-2026-35672:

7.5

-

Basic Information

Basic Information

Is this CVE running in your environment?

Technical Details

Technical Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

Vulnerability IntelligenceMiggo AI

Unlock WAF rules for this CVE

WAF Protection Rules

WAF Rule

Reasoning

Basic Information

Basic Information

Technical Details

7.5

7.5

CVE-2026-35672: phpMyFAQ: Default Empty API Token Authentication Bypass

Summary

Details

Vulnerability IntelligenceMiggo AI

Root Cause Analysis

Vulnerable functions

PoC

Impact

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI

Vulnerability Intelligence
Miggo AI