CVE-2026-67602 — CVSS 9.1 CRITICAL Severity | NVD Vulnerability Record

Executive Summary

The phpIPAM REST API authentication bypass (CVE‑2026‑67602) permits unauthenticated actors to obtain full API control by leveraging a numeric database row identifier as an API token. All deployments of phpIPAM versions prior to 1.8.2 are exposed, risking complete manipulation of IP address management data. Immediate decision is required to approve emergency patch deployment or implement compensating controls to block unauthenticated API access.

Verified Facts

• phpIPAM before 1.8.2 contains an authentication bypass vulnerability in the REST API — NVD article.
• The bypass exploits an insecure object cache keying mechanism that uses only the lookup value without the column name — NVD article.
• Attackers can use the numeric database row identifier as an API token to read, write, and delete all IP address management records — NVD article.

Threat Classification

Threat type: Authentication Bypass via REST API (HIGH CONFIDENCE). Affected sectors: any organization that deploys phpIPAM for IP address management, notably telecom, data center, and cloud service providers (MEDIUM CONFIDENCE). Geographic scope: Global, as phpIPAM is open‑source and used worldwide (MEDIUM CONFIDENCE). Exploitation status: No public evidence of active exploitation in the source (MEDIUM CONFIDENCE). Attacker motivation: Obtain unrestricted access to network inventory for further lateral movement or sabotage (MEDIUM CONFIDENCE).

Threat Severity Assessment

• Exploitability: Network‑reachable, no authentication required (HIGH CONFIDENCE).
• Impact scope: Full read/write/delete of IPAM records, compromising network topology and security controls (HIGH CONFIDENCE).
• Prevalence: Vulnerability present in all phpIPAM installations prior to 1.8.2 (MEDIUM CONFIDENCE).
• CVSS score: 9.1 (CRITICAL) (HIGH CONFIDENCE).

Business Impact

Compromise of phpIPAM data can lead to unauthorized IP reallocation, creation of rogue services, and disruption of network operations, potentially causing outage durations measured in hours. Under GDPR or NIS2, loss of network inventory may be classified as a breach of integrity, exposing the organization to fines up to €10 million or 2 % of annual turnover. SOC 2 compliance could be jeopardized by failure to protect logical access controls, prompting audit penalties. Reputational damage may arise from public disclosure of network manipulation, eroding customer trust.

Technical Analysis

• Attack vector: Remote network access to phpIPAM REST endpoint (AV:N).
• Exploitation chain: Unauthenticated request → cache entry created during app_id lookup → same cache entry satisfies subsequent app_code lookup → numeric DB row ID accepted as API token.
• Affected component: phpIPAM REST API object cache (lookup key only value, missing column identifier).
• Vulnerable versions: phpIPAM < 1.8.2.
• Root cause: CWE‑706 – Improper Restriction of XML External Entity Reference (insecure cache keying).
• CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.

CVE Analysis

• CVE‑2026‑67602 — phpIPAM < 1.8.2 — CWE‑706 — Network‑only attack, no authentication required — Patch available in phpIPAM 1.8.2 release.

MITRE ATT&CK Mapping

• Credential Access → T1078: Valid Accounts — attackers use a numeric database row identifier as an API token to gain authorized‑like access.

IOC Intelligence

No public IOCs confirmed at time of publication.

Behavioral IOC categories for rule creation:

• REST API calls to phpIPAM endpoints containing a numeric “token” parameter matching a database row ID pattern (e.g., /^\d+$/).
• Cache‑key mismatch errors logged by phpIPAM indicating lookup value without column context.
• Successful HTTP POST/PUT/DELETE requests to /api/* without prior authentication headers.
• Audit log entries showing creation, modification, or deletion of IP address objects originating from unknown source IPs.

Detection Engineering Guidance

• Log source: phpIPAM web server access logs (Apache/Nginx) – monitor HTTP method, URL, query string, and response code.
• Log source: phpIPAM application logs – look for “Cache key collision” or “Authentication bypass” messages.
• Log source: Database audit logs – flag SELECT/INSERT/UPDATE/DELETE on ip_address tables initiated by API token values.
• Detection logic: Flag any API request to /api/ that includes a numeric token parameter without a preceding successful login event within the same session.
• Telemetry fields: client_ip, request_method, request_uri, query_string, auth_status, response_code.

Sigma Rules

title: phpIPAM Unauthorized API Token Usage
id: 3f9c2d1e-8b4a-4f6a-9c2e-1a2b3c4d5e6f
status: stable
description: Detects phpIPAM REST API calls that contain a numeric token parameter without prior authentication, indicating possible exploitation of CVE‑2026‑67602.
author: CYBERDUDEBIVASH Sentinel Apex
logsource:
    product: webserver
    service: phpipam
detection:
    selection:
        uri|contains: "/api/"
        query_token|regex: 'token=\d+$'
    filter:
        auth_status: "authenticated"
    condition: selection and not filter
falsepositives:
    - Internal automation scripts that use static numeric tokens
level: high
tags:
    - attack.t1078

Threat Hunting Queries

• Hypothesis: Unauthenticated API calls with numeric token parameter – Source: Web server access logs; Query: `uri:"/api/" AND query:"token=" AND NOT auth_status:"authenticated"`.
• Hypothesis: Cache key collision events in phpIPAM logs – Source: Application logs; Query: `message:"Cache key collision"`.
• Hypothesis: Database modifications from unknown IPs – Source: DB audit logs; Query: `table:"ip_address" AND operation IN ("INSERT","UPDATE","DELETE") AND client_ip NOT IN (SELECT ip FROM known_admins)`.
• Hypothesis: High volume of DELETE requests to /api/ – Source: Web logs; Query: `uri:"/api/" AND method:"DELETE" AND response_code:200`.
• Hypothesis: Repeated failed authentication attempts followed by successful token use – Source: Auth logs + Web logs; Query: `auth_failure_count>5 AND later uri:"/api/" AND query_token MATCHES "\d+"`.

SOC Analyst Playbook

• P0 – Verify presence of phpIPAM version < 1.8.2 on assets (Asset Inventory, CMDB).
• P0 – Block unauthenticated access to phpIPAM REST endpoints via firewall or WAF rule (source IP allowlist).
• P1 – Search web server and application logs for “Cache key collision” or numeric token usage (Logstash/ELK, Splunk).
• P1 – Isolate affected phpIPAM instances and enable read‑only mode pending patch (systemctl stop php-fpm).
• P2 – Apply phpIPAM 1.8.2 patch or upgrade to latest release (package manager, Git pull).
• P2 – Conduct post‑patch validation by re‑executing detection queries and confirming no unauthorized API activity.

Executive Decision Matrix

Executive Recommendations

• Day 1‑7: Deploy immediate firewall/WAF rule to deny unauthenticated phpIPAM API calls and begin patch rollout to version 1.8.2.
• Day 8‑30: Conduct comprehensive inventory of all phpIPAM deployments, enforce strict API authentication, and integrate detection rules (Sigma) into SIEM.
• Day 31‑90: Establish a formal open‑source component risk management program, including automated vulnerability scanning and vendor‑managed patch cadence.

MSSP Opportunities

• Prioritize client notification for any organization running phpIPAM < 1.8.2, emphasizing the critical CVE‑2026‑67602 risk.
• Deploy the provided Sigma rule across client SIEM platforms to surface unauthorized API token usage.
• Activate threat hunting engagements using the five listed hypotheses to validate exposure on client environments.
• Offer advisory services to assist clients in patching phpIPAM and hardening API access controls, positioning CYBERDUDEBIVASH® SENTINEL APEX as the authoritative source.

🔗 Related Intelligence Reports

• Related topic: CVE-2026-76840 — CVSS 9.6 CRITICAL Severity | NVD Vulnerability Record
• Related topic: CVE-2026-78211 — CVSS 9.8 CRITICAL Severity | NVD Vulnerability Record
• Related topic: CVE-2026-78167 — CVSS 10.0 CRITICAL Severity | NVD Vulnerability Record
• Related topic: CVE-2026-78168 — CVSS 9.8 CRITICAL Severity | NVD Vulnerability Record
• Related topic: CVE-2026-78169 — CVSS 9.9 CRITICAL Severity | NVD Vulnerability Record