Vulnerability details
CVE-2026-111911
thorsten phpMyFAQ
phpMyFAQ 4.0.0 before 4.1.9 Authentication Bypass via WebAuthn Credential Injection
CVSS 4.0
9.3Critical
Official description
phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints attach credentials to any account without authentication or challenge validation. Attackers can stage a victim username, submit a forged fmt=none attestation to register a passkey, then log in bypassing passwords and TOTP for account takeover.
CVSS scores
| Score | Version | Source | Vector |
|---|---|---|---|
| 9.3Critical | 4.0 | CVEProject cvelistV5 (CNA) (VulnCheck) | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| 9.8Critical | 3.1 | CVEProject cvelistV5 (CNA) (VulnCheck) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
Affected products
| Vendor | Product | Versions | Source |
|---|---|---|---|
| thorsten | phpMyFAQ | 4.0.0 ≤ v < 4.1.9 | CVEProject cvelistV5 (CNA) |
References and advisories
3- https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-rg9h-f29v-xhxr vendor-advisory
- https://www.vulncheck.com/advisories/phpmyfaq-4.0.0-before-4.1.9-authentication-bypass-via-webauthn-credential-injection third-party-advisory
- https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-g6cq-6rqg-6c9p vendor-advisory
Kolun on Telegram @kolunsec
Exploited CVEs, key news and a daily digest
Alerts for this product's next CVEsFollow the product to get new vulnerabilities on Telegram.
Details
- Published
- 2026-10-17
- Last updated
- 2026-10-19
- State
- Published
- Assigner (CNA)
- VulnCheck
- Kolun priority
- 25 · Low
Exploit prediction (EPSS)
0.53%
Probability of exploitation in 30 days
45.3%
Percentile (among all CVEs)
SSVC assessment (CISA)
- Automatable
- Yes
- Exploitation
- Proof of concept
- Technical impact
- Total
Weaknesses (CWE)
- CWE-287Improper Authentication