CVE-2026-35675: phpMyFAQ - Authentication Bypass via Missing Password Reset Token in /api/user/password/update
phpMyFAQ before 4.1.3 contains an authentication bypass vulnerability in the password reset endpoint that allows unauthenticated attackers to reset any user account password without token verification or email confirmation. Attackers can enumerate valid usernames, obtain plaintext passwords via email, and achieve complete account takeover including administrative access.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
phpMyFAQto a version that resolves this vulnerability.Fixed in 4.1.3 - Compensating control
Block or restrict access to the /api/user/password/update endpoint (for example via WAF rule, reverse-proxy, or firewall) until phpMyFAQ is upgraded to version 4.1.3.
- Operational
Assume possible account compromise: rotate passwords for impacted accounts (especially administrative accounts), invalidate active sessions and API tokens, and review authentication and password-reset logs for unauthorized resets or access.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-35675?
The severity of CVE-2026-35675 is rated as high with a score of 8.8.
What does CVE-2026-35675 affect?
CVE-2026-35675 affects phpMyFAQ versions before 4.1.3.
How do I fix CVE-2026-35675?
To mitigate CVE-2026-35675, you should upgrade phpMyFAQ to version 4.1.3 or later.
What type of vulnerability is CVE-2026-35675?
CVE-2026-35675 is an authentication bypass vulnerability.
What can attackers do with CVE-2026-35675?
Attackers can exploit CVE-2026-35675 to reset any user account password without token verification or email confirmation.