CVE-2026-111911
CVE-2026-111911 · phpMyFAQ 4.0.0 before 4.1.9 Authentication Bypass via WebAuthn Credential Injection
This page contains facts from public vulnerability sources. Check the original advisory before updating.
phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints attach credentials to any account without authentication or challenge validation. Attackers can stage a victim username, submit a forged fmt=none attestation to register a passkey, then log in bypassing passwords and TOTP for account takeover.
CVSS 9.3 · Critical · EPSS 0.5% · Fix available
- Published
- Updated
Affected products and versions
phpmyfaq
- Versions
- ≥ 4.0.0, < 4.1.9: Affected (semver)
- 4.1.9: Not affected (semver)
Update to 4.1.9
Original sources
- https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-g6cq-6rqg-6c9p
- https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-rg9h-f29v-xhxr
- https://www.vulncheck.com/advisories/phpmyfaq-4.0.0-before-4.1.9-authentication-bypass-via-webauthn-credential-injection
- https://nvd.nist.gov/vuln/detail/CVE-2026-111911