CVE-2026-128023
Deferred Deferred - Pending Action

Authentication Bypass in FrankenPHP via Dot-Form Headers

Publication date: 2026-11-13

Last updated on: 2026-11-13

Assigner: VulnCheck

Description
FrankenPHP before 1.13.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to spoof trusted headers by sending dot-form header names that PHP rewrites to underscores. Attackers can send headers like X.Authenticated.User or X.Forwarded.For that map to $_SERVER keys, spoofing user identity, client IP, or scheme.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-13
Last Modified
2026-11-13
Generated
2026-11-13
AI Q&A
2026-11-13
EPSS Evaluated
N/A
NVD
CVE-2026-128023
EUVD
EUVD-2026-125079

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
frankenphp frankenphp to 1.13.0 (exc)
frankenphp frankenphp 1.12.7

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-290 This attack-focused weakness is caused by incorrectly implemented authentication schemes that are subject to spoofing attacks.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

FrankenPHP before 1.13.0 has an authentication bypass flaw where unauthenticated attackers can spoof trusted headers by sending dot-form header names. PHP rewrites these to underscores, allowing attackers to manipulate $_SERVER keys. This lets them spoof user identity, client IP, or scheme by sending headers like X.Authenticated.User or X.Forwarded.For.

Detection Guidance

Check for dot-form header names in HTTP requests that map to $_SERVER keys like X_Authenticated_User or X_Forwarded_For. Inspect server logs for unusual header patterns or spoofed user identities.

Impact Analysis

This vulnerability allows attackers to bypass authentication and impersonate legitimate users or systems. They could gain unauthorized access to sensitive data, perform actions as other users, or manipulate IP-based restrictions. Systems relying on header-based authentication or IP validation are particularly at risk.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and access control. Non-compliance may result in legal penalties, reputational damage, and loss of trust. Organizations must patch systems to maintain compliance.

Mitigation Strategies

Upgrade FrankenPHP to version 1.13.0 or later to patch the authentication bypass. If immediate upgrade is not possible, implement strict header validation in your application to reject dot-form headers.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-128023. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...