CVE-2026-22205
SPIP < 4.4.10 Authentication Bypass via PHP Type Juggling
Summary
SPIP < 4.4.10 Authentication Bypass via PHP Type Juggling
Original description
The description as published by the source.
SPIP versions prior to 4.4.10 contain an authentication bypass vulnerability caused by PHP type juggling that allows unauthenticated attackers to access protected information. Attackers can exploit loose type comparisons in authentication logic to bypass login verification and retrieve sensitive internal data.
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2026-22205 spip
- Ubuntu UBUNTU-CVE-2026-22205 spip
References
- advisory github.com
- advisory nvd.nist.gov
- advisory vulncheck.com
- patch blog.spip.net
- web git.spip.net