# CVE-2026-35675: phpMyFAQ authentication bypass in password reset API

Source: https://junglewise.ai/threats/cve-2026-35675-phpmyfaq-authentication-bypass-in-password-reset-api  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-28. Updated: 2026-05-28  
License: CC BY 4.0 with a link back

CVE-2026-35675 · Severity: high · CVSS 8.2 · Published 2026-05-28

phpMyFAQ, an open-source knowledge base system, contains a critical flaw in how it handles password resets. An unauthorized attacker can force the system to reset any user's password—including administrative accounts—simply by knowing their username and email address. This allows an attacker to take full control of the knowledge base, potentially exposing private documentation, modifying content, or locking out legitimate users.

Technologies: [phpmyfaq/phpmyfaq (Packagist)](https://junglewise.ai/threats/technologies/phpmyfaq-phpmyfaq), [thorsten/phpmyfaq (Packagist)](https://junglewise.ai/threats/technologies/thorsten-phpmyfaq). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-35675 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-35675 being exploited in the wild.

**How severe is CVE-2026-35675?** High severity, with a CVSS score of 8.2, published 28 May 2026.

**Which products and versions are affected?** phpmyfaq/phpmyfaq (Packagist) ECOSYSTEM:introduced=0,fixed=4.1.3; thorsten/phpmyfaq (Packagist) ECOSYSTEM:introduced=0,fixed=4.1.3.

**Is there a fix for CVE-2026-35675?** Yes. phpmyfaq/phpmyfaq (Packagist): upgrade to 4.1.3 or later; thorsten/phpmyfaq (Packagist): upgrade to 4.1.3 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-35675 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-35675?** Check whether you run phpmyfaq/phpmyfaq (Packagist) or thorsten/phpmyfaq (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- phpmyfaq/phpmyfaq (Packagist): upgrade to 4.1.3 or later

  ```sh
  composer require phpmyfaq/phpmyfaq:^4.1.3
  ```

- thorsten/phpmyfaq (Packagist): upgrade to 4.1.3 or later

  ```sh
  composer require thorsten/phpmyfaq:^4.1.3
  ```


## Technical details

An authentication bypass exists in the `updatePassword()` method of the `UnauthorizedUserController.php` component in phpMyFAQ. The API endpoint `/api/user/password/update` processes PUT requests using only a username and email address without requiring a cryptographic reset token or prior email verification. Because the endpoint also lacks rate limiting, attackers can enumerate valid account details and trigger an immediate password reset. Upon a successful request, the system generates a new plaintext password and sends it to the user's email, effectively allowing an attacker who has compromised the recipient's email or can predict the reset behavior to achieve full account takeover. The vulnerability is addressed in version 4.1.3.

## Affected products

- thorsten phpMyFAQ < 4.1.3

## Identifiers

- CVE-2026-35675
- GHSA-w9xh-5f39-vq89

## Timeline

- 2026-05-14: advisory: Vendor advisory published on GitHub
- 2026-05-28: disclosed: NVD publication date
- 2026-05-28: patched: Fix confirmed in version 4.1.3

## References

- [https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-w9xh-5f39-vq89](https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-w9xh-5f39-vq89)
- [https://www.vulncheck.com/advisories/phpmyfaq-authentication-bypass-via-missing-password-reset-token-in-api-user-password-update](https://www.vulncheck.com/advisories/phpmyfaq-authentication-bypass-via-missing-password-reset-token-in-api-user-password-update)

## Related threats

- [phpMyFAQ SQL injection in StopWords::add()](https://junglewise.ai/threats/cve-2026-56738-phpmyfaq-sql-injection-in-stopwords-add)
- [phpMyFAQ SQL LIKE wildcard injection in chat user search](https://junglewise.ai/threats/cve-2026-47132-phpmyfaq-sql-like-wildcard-injection-in-chat-user-search)
- [phpMyFAQ two-factor authentication password bypass](https://junglewise.ai/threats/cve-2026-56737-phpmyfaq-two-factor-authentication-password-bypass)
- [phpMyFAQ stored XSS in admin FAQ editor via HTML entity bypass](https://junglewise.ai/threats/cve-2026-56736-phpmyfaq-stored-xss-in-admin-faq-editor-via-html-entity-bypass)
- [phpMyFAQ information disclosure of inactive FAQ content in public API](https://junglewise.ai/threats/cve-2026-57994-phpmyfaq-information-disclosure-of-inactive-faq-content-in-public)