CVE-2026-35675 describes an authentication bypass vulnerability in phpMyFAQ before version 4.1.3. The vulnerability exists in the password reset functionality, where the system fails to properly restrict excessive authentication attempts and does not require token verification or email confirmation to reset passwords. This enables unauthenticated attackers to reset passwords of arbitrary user accounts, enumerate valid usernames, and obtain plaintext passwords sent by email. The vulnerability has a CVSS 3.1 base score of 8.2, indicating high severity with network attack vector, low attack complexity, no privileges or user interaction required, and impacts confidentiality and integrity.

Successful exploitation allows attackers to reset any user’s password without authentication, enumerate valid usernames, and receive plaintext passwords via email. This leads to complete account takeover, including administrative accounts, compromising confidentiality and integrity of the system. There is no indication of availability impact. No known exploits in the wild have been reported yet.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or patch link is provided, users should monitor the vendor's announcements for updates. Until a patch is available, restrict access to the password reset endpoint if possible and consider additional monitoring or temporary mitigations to prevent abuse of the password reset functionality.