Description
FrankenPHP before 1.13.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to spoof trusted headers by sending dot-form header names that PHP rewrites to underscores. Attackers can send headers like X.Authenticated.User or X.Forwarded.For that map to $_SERVER keys, spoofing user identity, client IP, or scheme.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| PHP | frankenphp | 0 <1.13.0 | — |