Flextype v1.0.0-alpha.3 NULL access_token Authentication Bypass
Flextype CMS v1.0.0-alpha.3 API endpoints accept a NULL access_token because isset() validation lets requests bypass authentication.
Flextype CMS v1.0.0-alpha.3 API endpoints can declare access_token as a required parameter, but required-parameter validation only verifies the key exists in the request data. Authentication is then verified inside an isset($data['access_token']) condition, which in PHP treats a NULL value as absent. This allows requests supplying a NULL access_token to bypass authentication on affected endpoints. The flaw was disclosed on the Full Disclosure mailing list on September 3, 2026.
- Required-parameter validation only checks key presence, not a valid non-empty token value
- isset($data['access_token']) treats NULL as absent, allowing authentication bypass
- No CVE identifier, patch, or exploitation evidence is referenced in the disclosure
- Vendors
- Flextype
- Products
- Flextype CMS
- Organizations
- Full Disclosure
From the original article
Posted by Ron E on Sep 03 Description Flextype CMS v1. 0. 0-alpha.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.