CVE-2026-124432 Details

An account enumeration vulnerability has been identified in phpMyFAQ versions 4.1.9 prior to 4.1.11 and 4.2.0 pre-releases prior to 4.2.0-beta.3. The vulnerability exists in the unauthenticated POST /api/webauthn/prepare-login endpoint, which is part of the WebAuthn authentication process. When this endpoint is accessed, it behaves differently based on whether the account has a registered passkey. For accounts with registered WebAuthn credentials, the response includes stable, real credential IDs. In contrast, for accounts without a passkey or that do not exist, the response contains a synthetic credential ID that changes every second, derived from the current time. This discrepancy allows unauthenticated attackers to determine which accounts have registered passkeys by comparing the response IDs from requests sent more than one second apart. The endpoint lacks proper rate limiting, enabling automated enumeration of passkey-registered accounts.

Users who do not require WebAuthn can disable the WebAuthn support option. For those who do need it, consider placing the endpoint behind an authenticated reverse proxy or applying network rate limiting.