AIKIDO-2026-544773
flightphp/core is vulnerable to Authorization Bypass
75
High Risk
This Affects:
flightphp/coreTL;DR
The framework engine assigns the flight.allow_method_override configuration flag inside a before('start') hook that first constructs the Request object, which caches the request verb using the static flag while it is still at its default enabled value. As a result the opt-out never influences routing, and an X-HTTP-Method-Override header or a _method field is still honored even when an operator disabled method override. A user-controlled request with a safe verb can be dispatched to a handler registered for a different HTTP method, bypassing middleware gated on the verb and enabling cross-site request forgery against destructive routes. The fix assigns the static flag before the request is built and refreshes the already-cached verb so the setting takes effect.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you rely on setting flight.allow_method_override to false to disable X-HTTP-Method-Override and _method method spoofing.
Background info
flightphp/core is vulnerable to Authorization Bypass in versions 3.18.1 - 3.19.0.
How to fix this
Upgrade the flightphp/core library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant