# CVE-2026-67602: phpIPAM REST API authentication bypass via cache key collision

Source: https://junglewise.ai/threats/cve-2026-67602-phpipam-rest-api-authentication-bypass-via-cache-key-collision  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-24. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-67602 · Severity: critical · CVSS 9.1 · Published 2026-08-24

phpIPAM is an open-source IP address management system that includes a REST API for programmatic access to IP records. The API contains an authentication bypass flaw that allows unauthenticated attackers to gain full API access and read, modify, or delete all IP address management records without valid credentials.

Technologies: [Phpipam](https://junglewise.ai/threats/technologies/phpipam). Vendors: [Phpipam](https://junglewise.ai/threats/vendors/phpipam).

## Quick answers

**Is CVE-2026-67602 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-67602 being exploited in the wild.

**How severe is CVE-2026-67602?** Critical severity, with a CVSS score of 9.1, published 24 August 2026.

**Which products and versions are affected?** Phpipam before 1.8.2.

**Is there a fix for CVE-2026-67602?** A patch was published on 2026-08-16: phpIPAM v1.8.2 released with security fixes Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-67602 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-67602?** Check whether you run Phpipam at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authentication bypass in the REST API caused by an insecure object cache keying mechanism. The cache lookup key includes only the search value without including the searched column name, creating a collision scenario where an entry written during an app_id lookup can satisfy a subsequent app_code lookup. An attacker can exploit this by using a numeric database row identifier as an API token, bypassing authentication entirely and gaining the ability to read, write, and delete IP address management records. The vulnerability affects phpIPAM before version 1.8.2 and is fixed in v1.8.2 released on August 16, 2026.

## Affected products

- phpIPAM phpIPAM before 1.8.2

## Timeline

- 2026-08-24: disclosed: CVE-2026-67602 published
- 2026-08-16: patched: phpIPAM v1.8.2 released with security fixes
- 2026-08-06: other: Security fix committed to repository

## References

- [https://github.com/phpipam/phpipam/commit/d29728fecca327f1ea825798908d0cfa4c62408e](https://github.com/phpipam/phpipam/commit/d29728fecca327f1ea825798908d0cfa4c62408e)
- [https://github.com/phpipam/phpipam/releases/tag/v1.8.2](https://github.com/phpipam/phpipam/releases/tag/v1.8.2)

## Related threats

- [phpIPAM reflected cross-site scripting in rack link creation](https://junglewise.ai/threats/cve-2026-115982-a-vulnerability-was-detected-in-phpipam-up-to-1-8-3-affected-by)
- [phpIPAM missing authorization check in customer pages](https://junglewise.ai/threats/cve-2026-108720-phpipam-through-1-8-3-contains-a-missing-authorization)
- [phpIPAM authorization bypass in User API controller](https://junglewise.ai/threats/cve-2026-97818-phpipam-through-1-8-3-has-incorrect-authorization-for-id-admins)
- [phpIPAM authenticated local file inclusion in API](https://junglewise.ai/threats/cve-2026-12194-phpipam-authenticated-local-file-inclusion-in-api)
- [phpIPAM cross-site scripting in Request IP form instructions](https://junglewise.ai/threats/cve-2025-61078-phpipam-cross-site-scripting-in-request-ip-form-instructions)