CVE-2026-35675CWE-307

phpMyFAQ - Authentication Bypass via Missing Password Reset Token in /api/user/password/update

High · published May 28, 2026

CVSS v4.0
8.8
EPSS
0%
Percentile
38.9
In the wild
Unconfirmed
What it is

phpMyFAQ before 4.1.3 contains an authentication bypass vulnerability in the password reset endpoint that allows unauthenticated attackers to reset any user account password without token verification or email confirmation. Attackers can enumerate valid usernames, obtain plaintext passwords via email, and achieve complete account takeover including administrative access.

The record
Technical detail
CVSS v4.0
8.8 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS
0.00460 · 38.9th percentile
Weakness
CWE-307 · Improper Restriction of Excessive Authentication Attempts
Published
2026-05-28T14:13Z
EPSS history
Timeline
  • 28 MAY 14:13Z
    phpMyFAQ - Authentication Bypass via Missing Password Reset Token in /api/user/password/update
    cvelistv5