phpIPAM before 1.8.2 contains an authentication bypass vulnerability in the REST API that allows unauthenticated attackers to gain full API access by exploiting an insecure object cache keying mechanism. The cache is keyed by lookup value alone without including the searched column, enabling an entry written during an app_id lookup to satisfy a subsequent app_code lookup, allowing attackers to use the numeric database row identifier as an API token to read, write, and delete all IP address management records.

phpIPAM versions before 1.8.2 contain a critical authentication bypass vulnerability in the REST API. The flaw stems from an insecure object cache keying mechanism where the cache is keyed solely by lookup value without including the searched column. This allows an entry written during an app_id lookup to satisfy a subsequent app_code lookup. Unauthenticated attackers can exploit this to use a numeric database row identifier as a valid API token. Once authenticated, attackers gain full API access and can read, write, and delete all IP address management records. The vulnerability has been patched in phpIPAM version 1.8.2. A fix is available via a specific commit on GitHub and details are documented by VulnCheck.