phpMyFAQ auth bypass via default empty API token

Executive brief

phpMyFAQ is an open-source knowledge base system. A security flaw in its programming interface (API) allows anyone to create, modify, or delete FAQ entries and categories without a password. This could allow an attacker to deface the knowledge base, insert malicious links, or spread misinformation, potentially damaging an organization's reputation or misleading its customers.

Technical details

An authentication bypass exists in phpMyFAQ's REST API due to an insecure default configuration and a flawed validation logic in the `hasValidToken()` method. During installation, the `api.apiClientToken` is initialized as an empty string. The authentication check uses a strict inequality comparison (`!==`) between the configured token and the `x-pmf-token` header provided in the request. If an attacker provides an empty `x-pmf-token` header, the comparison `'' !== ''` evaluates to false, bypassing the security check. This allows unauthenticated POST, PUT, and DELETE operations on FAQ content. The issue is patched in version 4.1.3.

Affected products

• thorsten phpMyFAQ >= 4.0.0, <= 4.1.2

Timeline

• 2026-05-14: disclosed
• 2026-05-20: advisory
• 2026-05-20: patched

References

• https://api.github.com/users/guayu-kakeru
• https://github.com/guayu-kakeru
• https://api.github.com/users/guayu-kakeru/gists%7B/gist_id%7D
• https://api.github.com/users/guayu-kakeru/repos
• https://avatars.githubusercontent.com/u/173120512?v=4
• https://api.github.com/users/guayu-kakeru/events%7B/privacy%7D