CVE-2026-111911: phpMyFAQ 4.0.0 before 4.1.9 Authentication Bypass via WebAuthn Credential Injection
phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints attach credentials to any account without authentication or challenge validation. Attackers can stage a victim username, submit a forged fmt=none attestation to register a passkey, then log in bypassing passwords and TOTP for account takeover.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
phpMyFAQ versions 4.0.0 before 4.1.9 are affected. The issue is reachable over the network and does not require an existing account or user interaction.
What does an attacker need to take over an account?
An attacker needs a victim username and can submit a forged fmt=none WebAuthn attestation to attach a passkey to that account. They can then authenticate with the injected credential, bypassing the account's password and TOTP protections.
Does enabling TOTP protect accounts from this attack?
No. The described attack allows login using the injected WebAuthn credential and bypasses both passwords and TOTP.
How can an organization determine whether it may be affected?
Verify the installed phpMyFAQ version; versions from 4.0.0 up to but not including 4.1.9 are affected. Also review WebAuthn credential registration activity for credentials attached to accounts without legitimate authenticated registration or challenge validation.