phpIPAM before version 1.8.2 contains an authentication bypass in its REST API that allows unauthenticated users to gain full API access by exploiting an insecure object cache keying mechanism; the cache is keyed solely by the lookup value and not by the searched column, so a result from an app_id query can satisfy an app_code query, enabling an attacker to use a numeric database row identifier as an API token to read, write, and delete all IP address management records.

The vulnerability affects all installations of phpIPAM running a version earlier than 1.8.2; users of phpIPAM 1.x must verify their current release and apply the recommended fix.

With a CVSS score of 9.3, this flaw is highly severe; the EPSS score is not available, but the vulnerability is not listed in the CISA KEV catalog; the likely attack vector is the REST API, where unauthenticated requests can retrieve database identifiers that are then used as unrestricted API tokens, allowing widespread compromise of IP address data.