8.8

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-35675

CVE-2026-35675: phpMyFAQ - Authentication Bypass via Missing Password Reset Token in /api/user/password/update

phpMyFAQ before 4.1.3 contains an authentication bypass vulnerability in the password reset endpoint that allows unauthenticated attackers to reset any user account password without token verification or email confirmation. Attackers can enumerate valid usernames, obtain plaintext passwords via email, and achieve complete account takeover including administrative access.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-35675

CVE-2026-35675:

8.8

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

SSVC / BOD 26-04 ↗

Exploitation pocAutomatable YesTech Impact Partial

Select your environment

→SSVCDeferfix on upgrade

Runtime reachability resolves your actual outcome.Book a demo

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
thorsten/phpmyfaq	composer	< 4.1.3	4.1.3
phpmyfaq/phpmyfaq	composer	< 4.1.3	4.1.3

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the updatePassword function within the UnauthorizedUserController. This function is responsible for handling password reset requests. The provided vulnerability description explicitly points out that this function lacks critical security checks. Specifically, it does not validate a password reset token, does not have rate limiting to prevent username and email enumeration, and does not send a confirmation email to the original address before proceeding with the password change. An attacker can exploit this by sending a simple PUT request to the /api/user/password/update endpoint with a guessed or enumerated username and email pair. If the pair is valid, the server resets the password and sends the new one to the user's email, which the attacker might have access to or can intercept. This allows for a full account takeover, including administrative accounts. The provided PoC confirms this attack vector. The vulnerable function signature is phpMyFAQ\Controller\Frontend\Api\UnauthorizedUserController::updatePassword, and it would be the primary indicator in a runtime profile during an exploit.

Vulnerable functions

phpMyFAQ\Controller\Frontend\Api\UnauthorizedUserController::updatePassword

phpmyfaq/src/phpMyFAQ/Controller/Frontend/Api/UnauthorizedUserController.php

The `updatePassword` function in the `UnauthorizedUserController` is vulnerable to an authentication bypass. It allows an unauthenticated attacker to reset the password of any user by sending a PUT request with the user's username and email address. The function does not perform any token verification, rate limiting, or email confirmation before resetting the password, leading to a complete account takeover.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.