Cypht CVE-2026-71981

Exploitation requires a valid authenticated session on the target Cypht instance (PR:L per CVSS 4.0 vector). The attacker must also reach the logout endpoint over the network (AV:N). No special Cypht configuration is required - the vulnerable back_query parameter in the logout handler is present by default in all installations before v2.12.2. A practical additional requirement is identifying a viable PHP gadget chain from the libraries loaded on the target server (e.g., Guzzle, Symfony components), though PHPGGC automates this for most common stacks. Exploitation is bounded by the need for prior account access and gadget-chain identification; it is not exploitable by unauthenticated attackers.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, score 8.7) correctly reflects network reachability, low complexity, and low-privilege authentication as the primary gate. The requiring of a valid authenticated session (PR:L) is the main limiting factor - attackers cannot exploit this without prior account access. However, in multi-tenant or self-registration-enabled Cypht deployments, obtaining a valid account is trivial. PHP deserialization gadget chains are well-understood, well-tooled, and independent of Cypht-specific knowledge, which reduces effective exploitation complexity. EPSS data was not provided; no CISA KEV listing exists; no public exploit code is identified. Real-world risk is moderate-to-high for internet-facing instances with open or low-barrier registration, and lower for private deployments with controlled user bases.

An authenticated Cypht user generates a serialized PHP gadget chain using PHPGGC against the PHP libraries loaded by the target server, base64-encodes the payload, and appends it as the back_query GET parameter in a crafted logout request. The server deserializes the object graph during logout processing, triggering magic method execution that runs arbitrary OS commands as the web server process. No public exploit code has been identified at time of analysis.