{"id":"CVE-2026-111911","published":"2026-10-17T19:16:33.500","lastModified":"2026-10-17T19:16:33.633","description":"phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints attach credentials to any account without authentication or challenge validation. Attackers can stage a victim username, submit a forged fmt=none attestation to register a passkey, then log in bypassing passwords and TOTP for account takeover.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-287"],"vendors":[],"products":[],"references":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-g6cq-6rqg-6c9p","tags":[]},{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-rg9h-f29v-xhxr","tags":[]},{"url":"https://www.vulncheck.com/advisories/phpmyfaq-4.0.0-before-4.1.9-authentication-bypass-via-webauthn-credential-injection","tags":[]}],"exploitRefs":[{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-g6cq-6rqg-6c9p","tags":[]},{"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-rg9h-f29v-xhxr","tags":[]}],"hasPoc":true,"ai":{"summary":"The vulnerability allows attackers to bypass authentication by registering WebAuthn passkeys for any user account without proper validation, enabling full account takeover without needing passwords or TOTP. This affects phpMyFAQ installations running version 4.0.0 through 4.1.8.","exploitability":"Exploitation is relatively straightforward requiring only a victim's username and ability to submit a forged attestation, with no prerequisites beyond access to the WebAuthn registration endpoint.","blast_radius":"The impact could be widespread as attackers can gain full administrative access to any user account, potentially leading to complete system compromise through unauthorized database access and configuration changes.","remediation":"Upgrade to phpMyFAQ version 4.1.9 or later to address this authentication bypass vulnerability.","detection":"Monitor for unusual WebAuthn registration attempts in authentication logs, particularly those with fmt=none attestation values that do not correspond to legitimate user sessions.","tags":["auth-bypass","webauthn","authentication","phpmyfaq"],"model":"garnet-coder","analyzedAt":"2026-10-18T09:53:12.881Z"}}