External risk intelligence

phpIPAM Authentication Bypass via REST API Object Cache

CVE advisorySeverity: CRITICAL (CVSS 9.3)

CVE-2026-67602

phpIPAM is an IP address management application that provides a REST API for automated network administration. These services are commonly deployed in network-accessible environments, including edge locations, to facilitate API integration and management tasks, making the API endpoint a frequent target for network-based interaction.

Authentication Bypass

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in the IP address management software allows unauthorized access to its API, potentially enabling attackers to view, modify, or delete all IP address records without needing credentials. This issue affects the REST API's handling of cached data, allowing a specific type of lookup to be bypassed. The main concern is confirming relevance and exposure.

Bypasses authentication for API access.
Allows unauthorized record management.
Confirm relevance and exposure.

Attack Path

How an attacker could exploit the issue

An attacker can bypass authentication and gain full access to the REST API by exploiting a flaw in how the application caches certain data. This flaw allows an attacker to trick the system into accepting a numerical database identifier as a valid API token, enabling them to read, write, and delete all IP address management records.

No authentication needed for access.
Cache keying flaw bypasses API authentication.
Full API access to manage IP records.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow unauthenticated attackers to bypass authentication on the REST API, leading to unauthorized access to all IP address management records. When supported by the advisory, this could enable attackers to read, write, or delete sensitive network infrastructure data.

IP address management records.
Unauthenticated API access.
Unauthorized data modification.

Operational Fix

Recommended remediation, mitigation, and detection steps

The phpIPAM REST API's authentication bypass vulnerability requires immediate attention from teams managing IP address management infrastructure. The first practical step is to identify all phpIPAM deployments, confirm their accessibility from external networks, and determine their business criticality. This will allow for accurate risk assessment and prioritization of remediation efforts, potentially involving coordination with vendors if the affected version is in use.

Application owners should take ownership.
Verify external API accessibility first.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is phpIPAM used for?

phpIPAM is an open-source web application designed for IP address management. Network administrators use it to track and document their network infrastructure, subnets, and connected devices. It features a REST API to automate these management tasks, allowing other software systems to programmatically query or update network records.

How does the CVE-2026-67602 authentication bypass work?

This vulnerability, classified as CWE-706, involves an insecure object cache keying mechanism. The application incorrectly uses only the lookup value to cache data rather than including the specific database column being searched. Because of this, a record cached for one type of search can be reused for another, letting an attacker substitute a numeric database row identifier for a valid API token.

Does this flaw trigger if I only use the web interface?

The vulnerability is specific to the REST API. An attacker must send malicious requests directly to the API endpoint to exploit the cache keying failure. If the API is disabled or if the application is accessed solely through the standard web user interface, the specific cache logic causing this bypass may not be engaged in a way that provides unauthorized API-level control.

Is my phpIPAM instance at risk?

According to Halo Surface Signal, this software is often deployed in network-accessible environments to facilitate automation. If your API endpoint is reachable over the internet or exposed to untrusted segments of your internal network, it is a high-priority concern. The vulnerability allows full control over network records without requiring valid credentials.

What should I do if I run phpIPAM?

Start by identifying all phpIPAM instances within your environment and verifying their network reachability. Determine which instances are exposed to external or non-critical networks. Prioritize these for investigation and upgrade to version 1.8.2 or later, which addresses the caching flaw. Ensure that any updates are tested in a non-production environment before full deployment.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.