CVE-2026-22205

HighPublic PoC

Published: 26 February 2026

Published

26 February 2026

Modified

02 March 2026

KEV Added

—

Patch

—

CVSS Score 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

EPSS Score 0.0034 56.8th percentile

Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-22205 is a high-severity Authentication Bypass Using an Alternate Path or Channel (CWE-288) vulnerability in Spip Spip. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 43.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190).

Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

AC-17 Remote Access

addresses: CWE-288

Authorizing remote access reduces the ability to bypass authentication via unauthorized alternate remote channels.

AC-9 Previous Logon Notification

addresses: CWE-288

Users can identify logons via alternate paths or channels by reviewing the previous logon time.

IA-10 Adaptive Authentication

addresses: CWE-288

Adaptive requirements can apply across access paths, reducing the ability to bypass authentication via alternate channels or paths.

IA-13 Identity Providers and Authorization Servers

addresses: CWE-288

Centralized IdPs close alternate authentication paths that enable bypass.

IA-8 Identification and Authentication (Non-organizational Users)

addresses: CWE-288

Enforces authentication for non-organizational users, making it harder to bypass via alternate paths or channels.

SC-11 Trusted Path

addresses: CWE-288

Requires authentication to occur exclusively over the isolated trusted path, directly preventing bypass via alternate or untrusted channels.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

Auth bypass in public-facing SPIP web app directly enables remote exploitation for unauthorized access to protected data.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

SPIP versions prior to 4.4.10 contain an authentication bypass vulnerability caused by PHP type juggling that allows unauthenticated attackers to access protected information. Attackers can exploit loose type comparisons in authentication logic to bypass login verification and retrieve sensitive internal…

data.

Deeper analysisAI

CVE-2026-22205 is an authentication bypass vulnerability affecting SPIP versions prior to 4.4.10. The flaw stems from PHP type juggling in the authentication logic, where loose type comparisons allow attackers to bypass login verification and access protected information, including sensitive internal data. It is classified under CWE-288 and carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N).

Unauthenticated attackers can exploit this vulnerability remotely over the network with low attack complexity and no user interaction. By leveraging the type juggling weakness, they can evade authentication checks to retrieve confidential data without impacting integrity or availability.

The official SPIP security advisory announces the release of version 4.4.10 as a patch addressing this issue. Security practitioners should upgrade to SPIP 4.4.10 or later, with further details available in the SPIP Git repository.