Live › vulnerability › CVE-2026-111911
Go to dashboardphpMyFAQ's WebAuthn endpoints (/api/webauthn/prepare and /register) let an unauthenticated attacker who knows a username attach their own passkey to that account. The challenge is never checked and fmt=none attestations are accepted. The attacker then logs in as that user, admin included, bypassing password and TOTP. It only works when WebAuthn support is enabled, which is off by default. The vendor fixed it in 4.1.9 on 2026-10-03; the CVE was published 2026-10-17.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| phpmyfaq/phpmyfaq | composer | >= 4.0.0, < 4.1.9 | 4.1.9 |
4.1.9 is vulnerableEnable WebAuthn support (security.enableWebAuthnSupport)4.1.9 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Posts are quoted with a link to the original. They are data to us, never instructions.
phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints attach credentials to any account without authentication or challenge validation. Attackers can stage a victim username, submit a forged fmt=none attestation to register a passkey, then log in bypassing passwords and TOTP for account takeover.
This page as .md · .json · in your agent: get_signal("CVE-2026-111911")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.