CVE-2026-111911 in phpMyFAQ
Summary
by MITRE • 10/17/2026
phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints attach credentials to any account without authentication or challenge validation. Attackers can stage a victim username, submit a forged fmt=none attestation to register a passkey, then log in bypassing passwords and TOTP for account takeover.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/17/2026
The security flaw identified in phpMyFAQ versions prior to 4.1.9 represents a critical authentication bypass vulnerability rooted in the improper implementation of WebAuthn registration protocols. Specifically, the system fails to enforce mandatory authentication checks or challenge validation when processing requests intended for registering new passkeys via WebAuthn endpoints. This architectural deficiency allows an unauthenticated actor to interact directly with the credential attachment logic without first proving their identity through standard means such as passwords or two-factor authentication tokens. The vulnerability stems from a lack of strict access control on sensitive administrative or user-profile modification functions, permitting any remote entity to invoke these operations freely.
From a technical perspective, the exploitation mechanism relies on manipulating the attestation format parameter within the WebAuthn registration request. By submitting a forged fmt=none value, an attacker can bypass standard cryptographic verification steps that would normally validate the authenticity of the authenticator device and ensure the challenge was issued by the server during a legitimate login flow. This manipulation effectively neutralizes the security guarantees provided by the FIDO2/WebAuthn standards, allowing the registration endpoint to associate a newly created public-private key pair with any target user account specified in the request payload. The system accepts this forged credential without verifying that the requester is indeed the owner of the targeted account or has been challenged for such an action.
The operational impact of this vulnerability is severe, leading directly to full account takeover capabilities. Once an attacker successfully registers a malicious passkey against a victim's username, they can subsequently authenticate as that user by presenting the corresponding private key during login attempts. This method effectively circumvents all other configured security measures, including complex passwords and Time-based One-Time Passwords (TOTP), because the system prioritizes the newly registered WebAuthn credential for authentication. Consequently, attackers gain unrestricted access to sensitive data stored within the FAQ platform, potentially leading to unauthorized modifications of content, exfiltration of user information, or further lateral movement if the compromised account possesses administrative privileges.
This vulnerability aligns with CWE-287 Improper Authentication and CWE-345 Insufficient Verification of Data Authenticity as defined by common weakness enumerations. In terms of tactical classification under MITRE ATT&CK, this behavior corresponds to T1078 Valid Accounts, specifically the technique of Account Manipulation where an adversary adds credentials to a legitimate account to maintain persistent access or escalate privileges without detection through traditional password-based monitoring systems. The ability to register passkeys remotely and silently makes this particularly dangerous for long-term persistence within compromised environments.
Mitigation strategies must prioritize immediate software updates to version 4.1.9 or later, where the developers have addressed these logic flaws by enforcing strict authentication requirements before allowing any credential registration operations. For organizations unable to patch immediately due to operational constraints, implementing a Web Application Firewall rule set that restricts access to WebAuthn registration endpoints based on valid session tokens and IP reputation can provide temporary relief. Additionally, security teams should audit existing configurations to ensure that no other administrative functions are exposed without robust multi-factor authentication requirements. Continuous monitoring for anomalous login patterns involving new passkey registrations from unfamiliar locations or devices is also recommended to detect potential exploitation attempts in real-time.