{"id":"CVE-2026-111911","kind":"vulnerability","aliases":["CVE-2026-111911"],"related":[],"title":"phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints…","description":"phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints attach credentials to any account without authentication or challenge validation. Attackers can stage a victim username, submit a forged fmt=none attestation to register a passkey, then log in bypassing passwords and TOTP for account takeover.","summary":"phpMyFAQ's WebAuthn endpoints (/api/webauthn/prepare and /register) let an unauthenticated attacker who knows a username attach their own passkey to that account. The challenge is never checked and fmt=none attestations are accepted. The attacker then logs in as that user, admin included, bypassing password and TOTP. It only works when WebAuthn support is enabled, which is off by default. The vendor fixed it in 4.1.9 on 2026-10-03; the CVE was published 2026-10-17.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"phpmyfaq/phpmyfaq","fixed":["4.1.9"],"affected":">= 4.0.0, < 4.1.9","ecosystem":"composer"}],"ecosystems":[],"tags":["authentication","package","php","phpmyfaq","self-hosted","webauthn"],"not_affected_if":["default-config","version-4.1.9-or-later","version-below-4.0.0","webauthn-disabled"],"how_to_check":"Check the installed version (the version shown in the admin panel, or the phpmyfaq/phpmyfaq entry in composer.lock). Below 4.1.9 is vulnerable. Then check Admin > Configuration > Security for 'Enable WebAuthn support' (security.enableWebAuthnSupport). If it is off, the endpoints are not exploitable. Look in web logs for unauthenticated POSTs to /api/webauthn/prepare and /api/webauthn/register, and review passkeys registered on admin accounts.","fix":"Upgrade phpMyFAQ to 4.1.9 or later. Later advisories (2026-10-09, 2026-10-21) cover other flaws, so take the latest 4.1.x. If you cannot upgrade, turn off WebAuthn support, then remove any passkeys you did not enrol and rotate the passwords of the accounts they were on.","status":"open","published_at":"2026-10-17T19:16:33+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-23T22:04:48+00:00","updated_at":"2026-10-23T23:27:43+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-10-23T22:04:48Z","model":"claude-haiku-5-5","output":{"fix":"Upgrade phpMyFAQ to 4.1.9 or later.","reach":"internet","impact":"high","summary":"phpMyFAQ 4.0.0 before 4.1.9 has a WebAuthn registration flaw: the endpoints attach a passkey to any account without authentication or challenge checks. An attacker can log in as a victim, bypassing both password and TOTP, and take over the account.","category":"package","who_cares":["phpmyfaq","php","self-hosted"],"confidence":0.7,"needs_auth":"no","worst_case":"Attacker takes over any user account, including administrators, without a password.","analyst_note":"Confirm the affected version range and whether the WebAuthn endpoints are on by default; check the NVD page and the phpMyFAQ advisory for a how-to-check command.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["version-4.1.9-or-later","version-below-4.0.0"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000463,"input_tokens":2785,"output_tokens":369,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Confirm the affected version range and whether the WebAuthn endpoints are on by default; check the NVD page and the phpMyFAQ advisory for a how-to-check command.","search":"'-03':98B '-10':97B,104B '-111911':16A,19A '-17':105B '-2026':15A,18A '/api/webauthn/prepare':33B '/register':35B '2026':96B,103B '4.0.0':2A,107C '4.1.9':4A,94B,109C 'accept':61B 'account':50B,123C,153C 'admin':70B 'attach':44B,119C 'attack':39B,63B,129C 'attest':59B,140C 'authent':7A,21B,112C,125C 'bypass':8A,72B,113C,148C 'challeng':52B,127C 'check':55B 'contain':5A,110C 'credenti':120C 'cve':14A,17A,100B 'default':88B 'enabl':83B 'endpoint':13A,32B,118C 'fix':91B 'fmt':57B,138C 'forg':137C 'host':27B 'includ':71B 'know':41B 'let':36B 'log':65B,146C 'never':54B 'none':58B,139C 'packag':22B 'passkey':47B,144C 'password':73B,149C 'php':23B 'phpmyfaq':1A,24B,29B,106C 'phpmyfaq/phpmyfaq':20A 'publish':102B 'regist':142C 'registr':12A,117C 'self':26B 'self-host':25B 'stage':131C 'submit':135C 'support':81B 'takeov':154C 'totp':75B,151C 'unauthent':38B 'user':69B 'usernam':43B,134C 'valid':128C 'vendor':90B 'victim':133C 'vulner':9A,114C 'webauthn':11A,28B,31B,80B,116C 'without':124C 'work':78B","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-17T19:16:33+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111911","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111911","severity":null,"published_at":"2026-10-17T19:16:33+00:00","modified_at":"2026-10-19T15:16:56+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-111911:448","url":null,"severity":null,"published_at":"2026-10-23T23:27:43+00:00","modified_at":"2026-10-23T23:27:43+00:00","first_seen_at":"2026-10-23T23:27:43+00:00","fetched_at":"2026-10-23T23:27:43+00:00","note":"Read GHSA-g6cq-6rqg-6c9p and vendor advisory 2026-10-03: only exploitable when security.enableWebAuthnSupport=true (non-default). PoC script is public in the GHSA; no exploitation reports found. Vendor says <=4.1.8, CVE says 4.0.0 to <4.1.9; earlier releases not individually verified. Later advisories (2026-10-09, 2026-10-21, up to 4.1.10) exist, so go to the latest release. X conversation is thin (10 posts in 7d), none saved."}],"documents":[{"id":1974,"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-g6cq-6rqg-6c9p","title":"GHSA-g6cq-6rqg-6c9p: Unauthenticated WebAuthn credential injection (phpMyFAQ)","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1977,"url":"https://www.phpmyfaq.de/security/advisory-2026-10-03/","title":"phpMyFAQ Security Advisory 2026-10-03","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":1981,"url":"https://www.vulncheck.com/advisories/phpmyfaq-4.0.0-before-4.1.9-authentication-bypass-via-webauthn-credential-injection","title":"VulnCheck: phpMyFAQ 4.0.0 before 4.1.9 WebAuthn credential injection","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1983,"url":"https://blog.malwlab.se/phpmyfaq-ships-28-security-fixes-then-publishes-the-receipts/","title":"phpMyFAQ ships 28 security fixes, then publishes the receipts","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"discussion","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}