GHSA-gp95-j463-vv28 phpMyFAQ: Default Empty API Token Authentication Bypass
SummaryA default empty API client token allows any unauthenticated user to create and modify FAQ entries, categories, and questions via the REST API. The vulnerability exists in all versions since API v4.0 was introduced because the installation process seeds `api.apiClientToken` with an empty string, and the `hasValidToken()` comparison logic cannot distinguish between "no token configured" and "attacker sent a matching empty token header."DetailsThe root cause is in two files:**1. Installation default** (`src/phpMyFAQ/Setup/Installation/DefaultDataSeeder.php`, line 277-278):**2. Authentication check** (`src/phpMyFAQ/Controller/AbstractController.php`, line 198-204):The method uses strict inequality (`!==`). When `api.apiClientToken` is `''` (default) and the attacker sends `x-pmf-token: ` (empty header value), the comparison becomes `'' !== ''` which evaluates to `false` — no exception is thrown, and authentication is completely bypassed.The OpenAPI annotations confirm the developer intended these endpoints to require authentication: write endpoints are tagged `'Endpoints with Authentication'` and document HTTP 401 responses, while read-only endpoints are tagged `'Public Endpoints'`.The following API endpoints call `$this->hasValidToken()` as their only authentication check:| File                                                    | Endpoint               | Method |
| ------------------------------------------------------- | ---------------------- | ------ |
| `src/.../Controller/Api/FaqController.php:701-703`      | `/api/v4.0/faq/create` | `POST` |
| `src/.../Controller/Api/FaqController.php:857-859`      | `/api/v4.0/faq/update` | `PUT`  |
| `src/.../Controller/Api/CategoryController.php:278-280` | `/api/v4.0/category`   | `POST` |
| `src/.../Controller/Api/QuestionController.php:89-91`   | `/api/v4.0/question`   | `POST` |PoC**Environment**: phpMyFAQ 4.2.0-alpha, PHP 8.4.16, SQLite, installed with all defaults.**Step 1 — Verify that requests without auth header are correctly rejected:**Response (HTTP 401 — correctly blocked):**Step 2 — Send the same request with an empty `x-pmf-token` header:**Response (HTTP 201 — bypass confirmed):**Step 3 — Category creation via the same bypass:**Response (HTTP 201):**Step 4 — Verify injected content is publicly visible:**Response (HTTP 200 — injected FAQ publicly exposed):**PoC with Python (urllib — no external dependencies):****Overlap Summary:**| Test                | x-pmf-token    | HTTP Status      | Result                     |
| ------------------- | -------------- | ---------------- | -------------------------- |
| No auth header      | *(not sent)*   | 401 Unauthorized | 🔒 Correctly blocked        |
| Empty token header  | `""`           | **201 Created**  | 🔓 Bypass confirmed         |
| Category creation   | `""`           | **201 Created**  | 🔓 Bypass confirmed         |
| Public verification | *(not needed)* | 200 OK           | 📄 Injected content visible |ImpactThis is an **authentication bypass (CWE-1188)** affecting any phpMyFAQ installation where the administrator has not explicitly set a non-empty API client token — which is the **default state after installation**.**Who is impacted?** Any organization running phpMyFAQ with default configuration. The REST API is enabled by default, and the token defaults to empty. No action by the administrator is required for the vulnerability to exist — it is the out-of-the-box state.**What can an attacker do?** Create and modify FAQ entries, categories, and questions without any authentication. This enables content injection for phishing, SEO spam, reputation damage, and distribution of malicious links through the knowledge base.**What is NOT affected?** Read-only API endpoints are intentionally public. Session-authenticated admin endpoints are not affected. File upload and backup endpoints require separate session-based authentication.
CVSS v4.0 score: 8.7
CVSS v3.1 score: 7.5