CVE-2026-35675: phpMyFAQ - Authentication Bypass via Missing Password Reset Token in /api/user/password/update

Synopsis

Authentication bypass in phpMyFAQ's password reset endpoint allows unauthenticated remote attackers to reset any user account password without a valid token or email confirmation. The vulnerability is reachable over the network and requires no credentials, meaning any attacker who can reach the application can trigger it. Successful exploitation gives the attacker full control over targeted accounts, including administrator accounts. A patched-image rebuild at version 4.1.3 is available on HarborGuard for environments running an affected version.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the phpMyFAQ application over the network; no local or adjacent access is needed, making any internet-exposed or internally networked instance a viable target.

• AuthenticationNot required

  No account or credentials of any kind are needed; the vulnerable endpoint is accessible to completely unauthenticated requests.

• Victim interactionNot required

  No user action is required; the attacker sends requests directly to the password reset API without involving any victim.

• Attack complexityDetail

  Exploitation is reliable and condition-free; no race conditions, memory layout dependencies, or special environmental factors need to be satisfied.

Blast Radius

• Attacker resets the password of any user account, including administrator accounts, and gains full authenticated access to the phpMyFAQ application.
• Attacker reads plaintext passwords delivered by the application's own reset email flow, which may be reused across other services if the victim shares credentials.
• With administrative access, the attacker can read stored FAQ content, user records, and any configuration data held in the application database.
• An attacker with admin-level access can modify, delete, or inject content across the entire FAQ knowledge base, corrupting or defacing published content.