---
id: "CVE-2026-111911"
kind: "vulnerability"
aliases: ["CVE-2026-111911"]
title: "phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints\u2026"
severity: "critical"
cvss: 9.8
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "phpmyfaq/phpmyfaq", "fixed": ["4.1.9"], "affected": ">= 4.0.0, < 4.1.9", "ecosystem": "composer"}]
ecosystems: []
tags: ["authentication", "package", "php", "phpmyfaq", "self-hosted", "webauthn"]
not_affected_if: ["default-config", "version-4.1.9-or-later", "version-below-4.0.0", "webauthn-disabled"]
published_at: "2026-10-17T19:16:33+00:00"
first_seen_at: "2026-10-23T21:57:14+00:00"
updated_at: "2026-10-23T23:27:43+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111911", "first_seen_at": "2026-10-23T21:57:14+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-23T23:27:43+00:00"}]
---

# phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints…

phpMyFAQ's WebAuthn endpoints (/api/webauthn/prepare and /register) let an unauthenticated attacker who knows a username attach their own passkey to that account. The challenge is never checked and fmt=none attestations are accepted. The attacker then logs in as that user, admin included, bypassing password and TOTP. It only works when WebAuthn support is enabled, which is off by default. The vendor fixed it in 4.1.9 on 2026-10-03; the CVE was published 2026-10-17.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- composer:phpmyfaq/phpmyfaq affected >= 4.0.0, < 4.1.9 fixed 4.1.9

## How to check

Check the installed version (the version shown in the admin panel, or the phpmyfaq/phpmyfaq entry in composer.lock). Below 4.1.9 is vulnerable. Then check Admin > Configuration > Security for 'Enable WebAuthn support' (security.enableWebAuthnSupport). If it is off, the endpoints are not exploitable. Look in web logs for unauthenticated POSTs to /api/webauthn/prepare and /api/webauthn/register, and review passkeys registered on admin accounts.

## Fix

Upgrade phpMyFAQ to 4.1.9 or later. Later advisories (2026-10-09, 2026-10-21) cover other flaws, so take the latest 4.1.x. If you cannot upgrade, turn off WebAuthn support, then remove any passkeys you did not enrol and rotate the passwords of the accounts they were on.

## Timeline

- 2026-10-23T21:57:14+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111911
- 2026-10-23T23:27:43+00:00 analyst — Read GHSA-g6cq-6rqg-6c9p and vendor advisory 2026-10-03: only exploitable when security.enableWebAuthnSupport=true (non-default). PoC script is public in the GHSA; no exploitation reports found. Vendor says <=4.1.8, CVE says 4.0.0 to <4.1.9; earlier releases not individually verified. Later advisories (2026-10-09, 2026-10-21, up to 4.1.10) exist, so go to the latest release. X conversation is thin (10 posts in 7d), none saved.

## Documents

- [advisory] GHSA-g6cq-6rqg-6c9p: Unauthenticated WebAuthn credential injection (phpMyFAQ) https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-g6cq-6rqg-6c9p
- [describes] VulnCheck: phpMyFAQ 4.0.0 before 4.1.9 WebAuthn credential injection https://www.vulncheck.com/advisories/phpmyfaq-4.0.0-before-4.1.9-authentication-bypass-via-webauthn-credential-injection
- [discussion] phpMyFAQ ships 28 security fixes, then publishes the receipts https://blog.malwlab.se/phpmyfaq-ships-28-security-fixes-then-publishes-the-receipts/
- [fix] phpMyFAQ Security Advisory 2026-10-03 https://www.phpmyfaq.de/security/advisory-2026-10-03/

## From the sources

phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints attach credentials to any account without authentication or challenge validation. Attackers can stage a victim username, submit a forged fmt=none attestation to register a passkey, then log in bypassing passwords and TOTP for account takeover.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_