CVE-2026-111911GHSA-g6cq-6rqg-6c9pGHSA-rg9h-f29v-xhxr
phpMyFAQ 4.0.0 before 4.1.9 Authentication Bypass via WebAuthn Credential Injection
thorsten phpMyFAQ
CVSS
9.3CriticalExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 19 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.42%Chance of exploitation activity in the next 30 days, higher than 35% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 4.1.9phpMyFAQCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints attach credentials to any account without authentication or challenge validation. Attackers can stage a victim username, submit a forged fmt=none attestation to register a passkey, then log in bypassing passwords and TOTP for account takeover.
Text from CVE List
Affected versions 2
- phpMyFAQaffected: 4.0.0 before 4.1.9CVE List
- phpMyFAQunaffected: 4.1.9CVE List
References 3
- github.com/thorsten/phpMyFAQ/security/advisories/GHSA-rg9h-f29v-xhxrAdvisoryvia CVE List
- vulncheck.com/advisories/phpmyfaq-4.0.0-before-4.1.9-authentication-bypass-via-webauthn-credential-injectionAdvisoryvia CVE List
- github.com/thorsten/phpMyFAQ/security/advisories/GHSA-g6cq-6rqg-6c9pExploitvia CVE List