CVE-2026-124432 · Package
NO FIX YET · SEE WHAT TO DO
phpMyFAQ's unauthenticated passkey login endpoint returns stable credential IDs for accounts that have passkeys but a time-based fallback ID for others. An attacker can compare responses to learn which accounts exist and obtain their credential IDs.
first public Oct 23, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Any public phpMyFAQ instance on an affected version exposes the passkey login endpoint without authentication. Instances with passkeys disabled or without the endpoint reachable from the internet are less exposed, but the sources do not say whether passkeys must be enabled for the endpoint to respond.
Not affected if no-passkeys, unaffected-version
Who cares php, phpmyfaq, self-hosted
4.1.9 or 4.2.0 pre-release builds before 4.2.0-beta.3 are affected.POST /api/webauthn/prepare-login on the public site.4.1.11 or later4.2.0-beta.3 or laterphpMyFAQ 4.1.9 before 4.1.11 and 4.2.0 pre-releases before 4.2.0-beta.3 contain an account enumeration vulnerability in the unauthenticated POST /api/webauthn/prepare-login endpoint, which returns stable stored credential IDs for passkey-registered accounts but an md5(time())-derived fallback ID otherwise. Unauthenticated attackers can compare allowCredentials IDs from requests sent more than one second apart, without rate limiting, to identify existing passkey-registered accounts and their credential IDs.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.