Threats tagged 'ghsa-prm4-w6g7-pw64'

FrankenPHP versions prior to 1.13.0 have an authentication bypass vulnerability that enables unauthenticated attackers to spoof trusted HTTP headers. This is achieved by sending dot-form header names that PHP internally rewrites to underscores, allowing attackers to impersonate user identity, client IP, or scheme information.