Executive brief
phpIPAM is an open-source IP address management system that includes a REST API for programmatic access to IP records. The API contains an authentication bypass flaw that allows unauthenticated attackers to gain full API access and read, modify, or delete all IP address management records without valid credentials.
Technical details
The vulnerability is an authentication bypass in the REST API caused by an insecure object cache keying mechanism. The cache lookup key includes only the search value without including the searched column name, creating a collision scenario where an entry written during an app_id lookup can satisfy a subsequent app_code lookup. An attacker can exploit this by using a numeric database row identifier as an API token, bypassing authentication entirely and gaining the ability to read, write, and delete IP address management records. The vulnerability affects phpIPAM before version 1.8.2 and is fixed in v1.8.2 released on August 16, 2026.
Affected products
- phpIPAM phpIPAM before 1.8.2
Timeline
- 2026-08-24: disclosed: CVE-2026-67602 published
- 2026-08-16: patched: phpIPAM v1.8.2 released with security fixes
- 2026-08-06: other: Security fix committed to repository