CVE-2026-67602: phpIPAM Authentication Bypass Vulnerability

CVE-2026-67602 Overview

CVE-2026-67602 is an authentication bypass vulnerability in phpIPAM versions before 1.8.2. The flaw resides in the REST API's object cache keying mechanism. The cache is keyed by lookup value alone without including the searched column. An entry written during an app_id lookup can satisfy a subsequent app_code lookup. Unauthenticated attackers exploit this collision to use a numeric database row identifier as a valid API token. Successful exploitation grants full API access to read, write, and delete all IP address management records. The weakness is classified under [CWE-706: Use of Incorrectly-Resolved Name or Reference].

Critical Impact
Unauthenticated attackers can gain full REST API access to IP address management data by supplying predictable numeric identifiers as API tokens.

Affected Products

phpIPAM versions before 1.8.2
phpIPAM REST API component (class.Addresses.php)
phpIPAM common object cache layer (class.Common.php)

Discovery Timeline

2026-08-24 - CVE-2026-67602 published to NVD
2026-08-24 - Last updated in NVD database

Technical Details for CVE-2026-67602

Vulnerability Analysis

phpIPAM caches API authentication lookups through a shared in-memory object store. The cache key is derived from the lookup value only, omitting the column name being queried. When the API resolves an app_id (a numeric row identifier) it stores the resulting object under that value. A later authentication attempt using app_code (the secret API token) reuses the same key. The cached row satisfies the app_code check, and the request is authenticated as the owner of that record. Attackers iterate through low integer values to bind to any registered API application.

Root Cause

The root cause is a name-collision defect in the caching function cache_check. The function accepted only an object type and a lookup value. It did not include the searched column as part of the key namespace. Two semantically distinct lookups therefore shared a single cache slot. This is the pattern captured by [CWE-706].

Attack Vector

Exploitation requires only network reachability to the phpIPAM REST API endpoint. The attacker submits an API request that first triggers an internal app_id lookup and then presents a numeric value as app_code. No prior credentials, user interaction, or elevated privileges are required.

php

// Vulnerable pattern in functions/classes/class.Addresses.php (pre-1.8.2)
$method = is_null($method) ? "id" : $method;

# check cache first
$cached = ($method=="id") ? $this->cache_check("ipaddresses", $id) : false;

// Patched in 1.8.2 - key now includes the search column
$cached = $this->cache_check("ipaddresses", $method, $id);

Source: phpIPAM commit d29728f

php

// Vulnerable pattern in functions/classes/class.Common.php (pre-1.8.2)
if(is_null($table)||is_blank($table)) return false;

$cached_item = $this->cache_check("fetch_all_objects", "t=$table f=$sortField o=$sortAsc");

// Patched in 1.8.2 - explicit column namespace "id" added
$cached_item = $this->cache_check("fetch_all_objects", "id", "t=$table f=$sortField o=$sortAsc");

Source: phpIPAM commit d29728f

Detection Methods for CVE-2026-67602

Indicators of Compromise

REST API requests to /api/<app>/ endpoints that authenticate successfully using small integer values as the app_code token.
Sequential enumeration patterns against /api/ paths from a single source IP within a short time window.
Unexpected read, write, or delete operations on IP address, subnet, or section objects performed by API applications outside of normal automation windows.

Detection Strategies

Inspect phpIPAM web server access logs for API requests where the presented app_code matches a numeric row identifier rather than a high-entropy secret.
Correlate authentication success events with source IP reputation and known automation ranges to isolate anomalous callers.
Compare running phpIPAM version strings against 1.8.2 across the estate to identify hosts that remain exposed.

Monitoring Recommendations

Forward phpIPAM and reverse proxy logs to a centralized analytics platform and alert on API 200 responses following short numeric app_code values.
Track baseline API call volume per application and alert when volume or object mutation rate deviates from norms.
Monitor database audit logs for bulk changes to ipaddresses, subnets, or sections tables initiated through the REST API.

How to Mitigate CVE-2026-67602

Immediate Actions Required

Upgrade phpIPAM to version 1.8.2 or later on all instances exposing the REST API.
Rotate all existing API application credentials (app_code values) after patching to invalidate any tokens that may have been captured.
Restrict network access to the phpIPAM REST API to trusted management networks until the upgrade is complete.

Patch Information

The fix is delivered in phpIPAM release v1.8.2 via commit d29728fecca327f1ea825798908d0cfa4c62408e. The patch changes cache_check call sites in class.Addresses.php and class.Common.php to include the searched column as part of the cache key, eliminating the collision between app_id and app_code lookups. Additional context is available in the VulnCheck advisory.

Workarounds

Disable the REST API in phpIPAM administration settings if it is not required for operations.
Place the phpIPAM API behind an authenticating reverse proxy or VPN that enforces client certificate or SSO checks.
Apply web application firewall rules that reject API requests where the app_code header value is shorter than the minimum expected token length.

bash

# Example: restrict phpIPAM API access at the reverse proxy (nginx)
location /api/ {
    allow 10.20.30.0/24;   # management network
    deny all;
    proxy_pass http://phpipam_backend;
}