CVE-2026-111911 Details
Description
phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints attach credentials to any account without authentication or challenge validation. Attackers can stage a victim username, submit a forged fmt=none attestation to register a passkey, then log in bypassing passwords and TOTP for account takeover.
A vulnerability allowing authentication bypass has been identified in phpMyFAQ versions 4.0.0 prior to 4.1.9. This issue arises because the WebAuthn registration endpoints can attach credentials to any account without requiring authentication or validating the associated challenge. As a result, an attacker can target a known username, submit a forged attestation to register a passkey, and then log in to the account, bypassing the need for a password or two-factor authentication, leading to account takeover.
Users can update to phpMyFAQ version 4.1.9 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 17, 2026CISA-ADP
Assessed Oct 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-g6cq-6rqg-6c9p | CISA-ADP | AdvisoryExploitTechnical AnalysisVendor |
| https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-g6cq-6rqg-6c9p | [email protected] | AdvisoryExploitTechnical AnalysisVendor |
| https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-rg9h-f29v-xhxr | [email protected] | AdvisoryExploitTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/phpmyfaq-4.0.0-before-4.1.9-authentication-bypass-via-webauthn-credential-injection | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| phpMyFAQ | >= 4.0.0, < 4.1.9 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 19, 2026 | CVE Modified | CISA-ADP |
| Oct 17, 2026 | New CVE Received | [email protected] |