CRITICAL 9.3 NVD
CVE-2026-111911
phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints attach credentials to any account without auth
phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints attach credentials to any account without authentication or challenge validation. Attackers can stage a victim username, submit a forged fmt=none attestation to register a passkey, then log in bypassing passwords and TOTP for account takeover.
References
- https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-g6cq-6rqg-6c9p
- https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-rg9h-f29v-xhxr
- https://www.vulncheck.com/advisories/phpmyfaq-4.0.0-before-4.1.9-authentication-bypass-via
This critical severity vulnerability with a CVSS score of 9.3 was published on 2026-10-17 via NVD.
Risk Timeline
CVE Disclosed2026-10-17 · -1 days ago
Remediation Resources
vulnfeed aggregates 16186 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.