High severity · published May 28, 2026
CVE-2026-35675
phpMyFAQ - Authentication Bypass via Missing Password Reset Token in /api/user/password/update
8.2
CVSS
0.4%
EPSS
No
On KEV
Description
phpMyFAQ before 4.1.3 contains an authentication bypass vulnerability in the password reset endpoint that allows unauthenticated attackers to reset any user account password without token verification or email confirmation. Attackers can enumerate valid usernames, obtain plaintext passwords via email, and achieve complete account takeover including administrative access.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 36% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
PH
phpMyFAQ · thorsten
before 4.1.3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-35675
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-35675
github.com
https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-w9xh-5f39-vq89
www.vulncheck.com
https://www.vulncheck.com/advisories/phpmyfaq-authentication-bypass-via-missing-password-reset-token-in-api-user-password-update
More from phpMyFAQ
9.8
CVE-2026-111911
phpMyFAQ 4.0.0 before 4.1.9 Authentication Bypass via WebAuthn Credential Injection
9.8
CVE-2026-46364
phpMyFAQ - SQL Injection via User-Agent Header in BuiltinCaptcha
9.4
CVE-2026-66398
phpMyFAQ before 4.1.6 Remote Code Execution via Configuration API
9.1
CVE-2026-45010
phpMyFAQ - Unauthenticated Two-Factor Authentication Brute-Force via /admin/check Endpoint
8.8
CVE-2026-75918
phpMyFAQ before 4.1.7 Authentication Bypass via Tracking File