{"id":"CVE-2026-128023","kind":"vulnerability","aliases":["CVE-2026-128023"],"related":[],"title":"FrankenPHP: dot-named headers let unauthenticated requests spoof user identity","description":"FrankenPHP before 1.13.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to spoof trusted headers by sending dot-form header names that PHP rewrites to underscores. Attackers can send headers like X.Authenticated.User or X.Forwarded.For that map to $_SERVER keys, spoofing user identity, client IP, or scheme.","summary":"FrankenPHP before 1.13.0 lets an unauthenticated attacker send headers with dot-form names such as X.Authenticated.User, which PHP rewrites to underscores so they appear as trusted $_SERVER values. An attacker can thereby spoof the user identity, client IP or request scheme that the application trusts.","severity":"critical","cvss":9.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["frankenphp","php","runtime","self-hosted"],"not_affected_if":["no-header-trust","patched-1.13.0"],"how_to_check":"- Check the FrankenPHP version with `frankenphp version`; versions below `1.13.0` are affected.\n- Look for application code that reads $_SERVER keys for user identity, client IP or scheme (for example authenticated user or forwarded-for values) set from request headers.","fix":"- Upgrade FrankenPHP to `1.13.0` or later.","status":"open","published_at":"2026-11-13T10:18:07+00:00","first_seen_at":"2026-11-13T10:47:31+00:00","triaged_at":"2026-11-13T10:48:40+00:00","updated_at":"2026-11-13T10:48:40+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-13T10:48:40Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade FrankenPHP to `1.13.0` or later.","reach":"internet","title":"FrankenPHP: dot-named headers let unauthenticated requests spoof user identity","impact":"high","summary":"FrankenPHP before 1.13.0 lets an unauthenticated attacker send headers with dot-form names such as X.Authenticated.User, which PHP rewrites to underscores so they appear as trusted $_SERVER values. An attacker can thereby spoof the user identity, client IP or request scheme that the application trusts.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["frankenphp","php","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"attacker impersonates users and spoofs client identity","analyst_note":"Check the vendor advisory on github.com and the VulnCheck advisory for exact affected configurations and any workaround before 1.13.0.","how_to_check":"- Check the FrankenPHP version with `frankenphp version`; versions below `1.13.0` are affected.\n- Look for application code that reads $_SERVER keys for user identity, client IP or scheme (for example authenticated user or forwarded-for values) set from request headers.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["patched-1.13.0","no-header-trust"],"who_is_affected":"Applications running FrankenPHP before 1.13.0 that trust $_SERVER values derived from request headers for authentication, client IP or scheme decisions are exposed. Deployments that do not use those values for trust decisions, or that run a patched version, can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000767,"input_tokens":4627,"output_tokens":608,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-128023':14A,17A '-2026':13A,16A '1.13.0':26B,72C 'allow':79C 'appear':48B 'applic':68B 'attack':30B,54B,81C,98C 'authent':75C 'bypass':76C 'client':61B,114C 'contain':73C 'cve':12A,15A 'dot':3A,35B,89C 'dot-form':34B,88C 'dot-nam':2A 'form':36B,90C 'frankenphp':1A,18B,24B,70C 'header':5A,32B,85C,91C,101C 'host':23B 'ident':11A,60B,113C 'ip':62B,115C 'key':110C 'let':6A,27B 'like':102C 'map':107C 'name':4A,37B,92C 'php':19B,42B,94C 'request':8A,64B 'rewrit':43B,95C 'runtim':20B 'scheme':65B,117C 'self':22B 'self-host':21B 'send':31B,87C,100C 'server':51B,109C 'spoof':9A,57B,83C,111C 'therebi':56B 'trust':50B,69B,84C 'unauthent':7A,29B,80C 'underscor':45B,97C 'user':10A,59B,112C 'valu':52B 'vulner':77C 'x.authenticated.user':40B,103C 'x.forwarded.for':105C","nicknames":[],"mitigations":[],"who_affected":"Applications running FrankenPHP before 1.13.0 that trust $_SERVER values derived from request headers for authentication, client IP or scheme decisions are exposed. Deployments that do not use those values for trust decisions, or that run a patched version, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","frankenphp","php","runtime","selfhosted"],"campaign_type":null,"search_a":"'-128023':14A,17A '-2026':13A,16A 'cve':12A,15A 'dot':3A 'dot-nam':2A 'frankenphp':1A 'header':5A 'ident':11A 'let':6A 'name':4A 'request':8A 'spoof':9A 'unauthent':7A 'user':10A","search_b":"'1.13.0':26B 'appear':48B 'applic':68B 'attack':30B,54B 'client':61B 'dot':35B 'dot-form':34B 'form':36B 'frankenphp':18B,24B 'header':32B 'host':23B 'ident':60B 'ip':62B 'let':27B 'name':37B 'php':19B,42B 'request':64B 'rewrit':43B 'runtim':20B 'scheme':65B 'self':22B 'self-host':21B 'send':31B 'server':51B 'spoof':57B 'therebi':56B 'trust':50B,69B 'unauthent':29B 'underscor':45B 'user':59B 'valu':52B 'x.authenticated.user':40B","search_c":"'1.13.0':72C 'allow':79C 'attack':81C,98C 'authent':75C 'bypass':76C 'client':114C 'contain':73C 'dot':89C 'dot-form':88C 'form':90C 'frankenphp':70C 'header':85C,91C,101C 'ident':113C 'ip':115C 'key':110C 'like':102C 'map':107C 'name':92C 'php':94C 'rewrit':95C 'scheme':117C 'send':87C,100C 'server':109C 'spoof':83C,111C 'trust':84C 'unauthent':80C 'underscor':97C 'user':112C 'vulner':77C 'x.authenticated.user':103C 'x.forwarded.for':105C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-04T14:04:42+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-128023","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-128023","severity":null,"published_at":"2026-11-13T10:18:07+00:00","modified_at":"2026-11-13T10:18:08+00:00","first_seen_at":"2026-11-13T10:47:31+00:00","fetched_at":"2026-11-13T10:47:31+00:00","note":null}],"documents":[{"id":145346,"url":"https://github.com/php/frankenphp/security/advisories/GHSA-qcrp-8483-f2f2","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-04T14:04:42+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":145347,"url":"https://www.vulncheck.com/advisories/frankenphp-before-1.13.0-authentication-bypass-via-dot-form-header-name-aliasing","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}