CVE-2026-76214: phpMyFAQ before 4.1.7 WebAuthn Replay Attack via Challenge
phpMyFAQ before 4.1.7 (affected versions <= 4.1.5) fails to persist the WebAuthn login challenge generated by prepareForLogin, because neither WebAuthn controller saves the mutated key objects back to the database. At login the anti-replay comparison is skipped by its own null guard, allowing an attacker who captures a successful WebAuthn assertion to replay it indefinitely and authenticate as the user without any interaction or hardware key.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
phpMyFAQto a version that resolves this vulnerability.Fixed in 4.1.7 - Operational
After upgrading to phpMyFAQ 4.1.7, ensure any WebAuthn login challenges/attempts that may have been replayed are no longer valid (revert/clear any outstanding authentication state as applicable in your deployment).
Event History
Frequently Asked Questions
Who is exposed to this issue?
phpMyFAQ deployments running affected versions up to 4.1.5 are exposed where WebAuthn login is used. The issue affects the WebAuthn authentication flow because the generated login challenge is not persisted.
What does an attacker need to exploit it?
An attacker needs to capture a successful WebAuthn assertion for the target user. They do not need user interaction or access to the user’s hardware security key to replay that captured assertion.
What is the practical impact of a captured assertion?
A captured successful assertion can be replayed indefinitely to authenticate as the associated user. The vulnerable login flow skips the anti-replay comparison when the expected challenge is null.
What versions should be remediated?
The affected versions are identified as phpMyFAQ versions 4.1.5 and earlier, with the issue fixed before 4.1.7. Upgrade to a version that includes the fix.