CVE-2026-128023

FrankenPHP authentication bypass in header name handling

critical · 9.1

Fix listed

FrankenPHP

Published Nov 13, 2026, 09:34 UTC

Description

FrankenPHP before 1.13.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to spoof trusted headers by sending dot-form header names that PHP rewrites to underscores. Attackers can send headers like X.Authenticated.User or X.Forwarded.For that map to $_SERVER keys, spoofing user identity, client IP, or scheme.

Reported fixed versions

1.13.0

Official CVE record Read Eden case study View source and advisories

Data from cve.now. Summaries, where shown, are licensed CC BY 4.0.