CVE-2026-128023: FrankenPHP before 1.13.0 Authentication Bypass via Dot-Form Header Name Aliasing
FrankenPHP before 1.13.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to spoof trusted headers by sending dot-form header names that PHP rewrites to underscores. Attackers can send headers like X.Authenticated.User or X.Forwarded.For that map to $SERVER keys, spoofing user identity, client IP, or scheme.
Affected Software
Event History
Frequently Asked Questions
Which deployments are most exposed to this issue?
Applications that trust PHP $_SERVER values derived from request headers for authentication, client IP address, or scheme decisions are exposed. Examples include deployments that rely on trusted identity or forwarding headers.
Does an attacker need an account or user interaction to exploit it?
No. The vulnerability is described as exploitable by unauthenticated attackers, and the vector specifies no required privileges or user interaction.
What can an attacker spoof if exploitation succeeds?
An attacker can spoof trusted header-derived values such as user identity, client IP address, or scheme. Dot-form names such as X.Authenticated.User and X.Forwarded.For can be rewritten into underscore-form PHP $_SERVER keys.