CVE-2026-128023
HIGH
NVD
CVSS Score
7.4
Severity
HIGH
Published
Nov 13, 2026
Vendor
unknown
Description
FrankenPHP before 1.13.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to spoof trusted headers by sending dot-form header names that PHP rewrites to underscores. Attackers can send headers like X.Authenticated.User or X.Forwarded.For that map to $_SERVER keys, spoofing user identity, client IP, or scheme.