---
id: CVE-2026-67602
title: >-
  phpIPAM before 1.8.2 contains an authentication bypass vulnerability in the
  REST API that allows unauthenticated attackers to gain full API access by
  exploiting an insecure object cache keying mechanism
summary: >-
  phpIPAM before 1.8.2 contains an authentication bypass vulnerability in the
  REST API that allows unauthenticated attackers to gain full API access by
  exploiting an insecure object cache keying mechanism. The cache is keyed by
  lookup valu…
severity: critical
cvss: 9.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N'
cwe:
  - CWE-706
published: '2026-08-24'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T20:43:32.537'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-67602'
references:
  - url: >-
      https://github.com/phpipam/phpipam/commit/d29728fecca327f1ea825798908d0cfa4c62408e
    label: disclosure@vulncheck.com
  - url: 'https://github.com/phpipam/phpipam/releases/tag/v1.8.2'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/phpipam-authentication-bypass-via-rest-api-object-cache
    label: disclosure@vulncheck.com
tags:
  - nvd
  - exploit-available
epss: 0.0064
epssPercentile: 0.48375
exploits:
  github: 1
  githubRepos:
    - >-
      https://github.com/Hunt-Benito/the-token-was-a-row-number-cve-2026-67602-phpipam-rest-api-authentication-bypass
  checkedAt: '2026-09-24T20:52:15.414Z'
exploitAvailable: true
ingestedAt: '2026-09-24T20:51:40.220Z'
---

## Overview

phpIPAM before 1.8.2 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to gain full API access by exploiting an insecure object cache keying mechanism. The cache is keyed by lookup value alone without including the searched column, enabling an entry written during an app_id lookup to satisfy a subsequent app_code lookup, allowing attackers to use the numeric database row identifier as an API token to read, write, and delete all IP address management records.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.