CVE-2026-128023 · Runtime
NO FIX YET · SEE WHAT TO DO
FrankenPHP before 1.13.0 lets an unauthenticated attacker send headers with dot-form names such as X.Authenticated.User, which PHP rewrites to underscores so they appear as trusted $_SERVER values. An attacker can thereby spoof the user identity, client IP or request scheme that the application trusts.
first public Oct 4, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applications running FrankenPHP before 1.13.0 that trust $_SERVER values derived from request headers for authentication, client IP or scheme decisions are exposed. Deployments that do not use those values for trust decisions, or that run a patched version, can skip it.
Not affected if no-header-trust, patched-1.13.0
Who cares frankenphp, php, self-hosted
frankenphp version; versions below 1.13.0 are affected.1.13.0 or later.FrankenPHP before 1.13.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to spoof trusted headers by sending dot-form header names that PHP rewrites to underscores. Attackers can send headers like X.Authenticated.User or X.Forwarded.For that map to $_SERVER keys, spoofing user identity, client IP, or scheme.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.