---
id: CVE-2026-35675
title: >-
  phpMyFAQ - Authentication Bypass via Missing Password Reset Token in
  /api/user/password/update
summary: >-
  phpMyFAQ before 4.1.3 contains an authentication bypass vulnerability in the
  password reset endpoint that allows unauthenticated attackers to reset any
  user account password without token verification or email confirmation.
  Attackers can…
severity: high
cvss: 8.2
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N'
cvssSource: cna
cwe:
  - CWE-307
vendor: thorsten
product: phpMyFAQ
affected:
  - phpMyFAQ < 4.1.3
ssvc:
  exploitation: poc
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-05-29T13:34:30.682914Z'
exploitAvailable: true
published: '2026-05-28'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:02:29.795Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-35675'
references:
  - url: >-
      https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-w9xh-5f39-vq89
    label: GitHub Security Advisory (GHSA-w9xh-5f39-vq89)
  - url: >-
      https://www.vulncheck.com/advisories/phpmyfaq-authentication-bypass-via-missing-password-reset-token-in-api-user-password-update
    label: >-
      VulnCheck Advisory: phpMyFAQ - Authentication Bypass via Missing Password
      Reset Token in /api/user/password/update
tags:
  - cve.org
  - exploit-available
epss: 0.00417
epssPercentile: 0.36243
ingestedAt: '2026-11-08T14:51:22.448Z'
---

## Overview

phpMyFAQ before 4.1.3 contains an authentication bypass vulnerability in the password reset endpoint that allows unauthenticated attackers to reset any user account password without token verification or email confirmation. Attackers can enumerate valid usernames, obtain plaintext passwords via email, and achieve complete account takeover including administrative access.

## Affected

- `phpMyFAQ < 4.1.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.