Search: CVE-2026-91768

CVE-2026-91768 is a vulnerability in the PHP FastCGI client access check for IPv6 addresses. The check incorrectly compares only the first 12 bytes of a 16-byte IPv6 address, effectively matching on a /96 prefix rather than the full address. This allows an attacker with an IPv6 address sharing the first 96 bits with an allowed client to bypass access restrictions and reach the FastCGI endpoint. The vulnerability has a medium severity with a CVSS score of 6.5.