CVE-2026-22205

HIGH

7.5

Description

SPIP versions prior to 4.4.10 contain an authentication bypass vulnerability caused by PHP type juggling that allows unauthenticated attackers to access protected information. Attackers can exploit loose type comparisons in authentication logic to bypass login verification and retrieve sensitive internal data.

CVE Details

CVSS v3.1 Score7.5

SeverityHIGH

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

Published2/26/2026

Last Modified3/2/2026

Sourcenvd

Honeypot Sightings0

Affected Products

spip:spip

Weaknesses (CWE)

CWE-288

References

https://blog.spip.net/Mise-a-jour-de-securite-sortie-de-SPIP-4-4-10.html(disclosure@vulncheck.com)

https://git.spip.net/spip/spip(disclosure@vulncheck.com)

https://www.vulncheck.com/advisories/spip-sql-injection-rce-via-union-php-tags(disclosure@vulncheck.com)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.