Executive Summary

A critical vulnerability (CVE-2026-67602) with a CVSS score of 9.1 was discovered in phpIPAM, an open-source IP address management tool. This vulnerability allows unauthenticated attackers to bypass authentication and gain full access to the REST API, potentially leading to unauthorized read, write, and delete operations on IP address management records. The vulnerability affects phpIPAM versions prior to 1.8.2.

Technical Analysis

The vulnerability is classified as an authentication bypass issue. It resides in the REST API of phpIPAM and is caused by an insecure object cache keying mechanism. The cache is keyed by lookup value alone without including the searched column. This flaw enables an entry written during an app_id lookup to satisfy a subsequent app_code lookup. As a result, attackers can use the numeric database row identifier as an API token to read, write, and delete all IP address management records.

How It Gets Exploited

An unauthenticated remote attacker can exploit this vulnerability by sending a crafted request to the REST API. The attacker would use the numeric database row identifier as an API token, which is obtained during an app_id lookup, to satisfy a subsequent app_code lookup. This allows the attacker to bypass authentication and gain full API access without needing valid credentials.

Impact Assessment

The impact of this vulnerability is significant. An attacker can achieve full API access, allowing them to read, write, and delete IP address management records. This could lead to unauthorized modifications, data breaches, or even disruption of IP address management services. The vulnerability has a CVSS score of 9.1, indicating a critical severity level. It affects phpIPAM versions prior to 1.8.2.

Recommended Actions

To mitigate this vulnerability, it is recommended to update phpIPAM to version 1.8.2 or later. Additionally, users should:
  • Implement network segmentation to limit access to the REST API.
  • Monitor API logs for suspicious activity.
  • Consider implementing additional authentication mechanisms for the REST API.

Sources

  • National Vulnerability Database (NVD) - CVE-2026-67602
  • phpIPAM GitHub repository
  • Vulncheck - phpIPAM Authentication Bypass via REST API Object Cache