{"id":"CVE-2026-124432","kind":"vulnerability","aliases":["CVE-2026-124432"],"related":[],"title":"phpMyFAQ: passkey login endpoint lets attackers enumerate existing accounts","description":"phpMyFAQ 4.1.9 before 4.1.11 and 4.2.0 pre-releases before 4.2.0-beta.3 contain an account enumeration vulnerability in the unauthenticated POST /api/webauthn/prepare-login endpoint, which returns stable stored credential IDs for passkey-registered accounts but an md5(time())-derived fallback ID otherwise. Unauthenticated attackers can compare allowCredentials IDs from requests sent more than one second apart, without rate limiting, to identify existing passkey-registered accounts and their credential IDs.","summary":"phpMyFAQ's unauthenticated passkey login endpoint returns stable credential IDs for accounts that have passkeys but a time-based fallback ID for others. An attacker can compare responses to learn which accounts exist and obtain their credential IDs.","severity":"high","cvss":7.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","php","phpmyfaq","self-hosted"],"not_affected_if":["no-passkeys","unaffected-version"],"how_to_check":"- Check the installed phpMyFAQ version: `4.1.9` or `4.2.0` pre-release builds before `4.2.0-beta.3` are affected.\n- Look for the passkey endpoint `POST /api/webauthn/prepare-login` on the public site.","fix":"- phpMyFAQ 4.1.x: move to `4.1.11` or later\n- phpMyFAQ 4.2.0 pre-releases: move to `4.2.0-beta.3` or later","status":"open","published_at":"2026-11-08T14:18:09+00:00","first_seen_at":"2026-11-08T14:48:38+00:00","triaged_at":"2026-11-08T14:49:22+00:00","updated_at":"2026-11-08T14:49:22+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-08T14:49:22Z","model":"claude-haiku-5-5","output":{"fix":"- phpMyFAQ 4.1.x: move to `4.1.11` or later\n- phpMyFAQ 4.2.0 pre-releases: move to `4.2.0-beta.3` or later","reach":"internet","title":"phpMyFAQ: passkey login endpoint lets attackers enumerate existing accounts","impact":"low","summary":"phpMyFAQ's unauthenticated passkey login endpoint returns stable credential IDs for accounts that have passkeys but a time-based fallback ID for others. An attacker can compare responses to learn which accounts exist and obtain their credential IDs.","audience":"businesses","category":"package","nicknames":[],"who_cares":["phpmyfaq","self-hosted","php"],"confidence":0.7,"fix_status":"available","needs_auth":"no","worst_case":"attacker learns which accounts have passkeys and their credential IDs","analyst_note":"","how_to_check":"- Check the installed phpMyFAQ version: `4.1.9` or `4.2.0` pre-release builds before `4.2.0-beta.3` are affected.\n- Look for the passkey endpoint `POST /api/webauthn/prepare-login` on the public site.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["unaffected-version","no-passkeys"],"who_is_affected":"Any public phpMyFAQ instance on an affected version exposes the passkey login endpoint without authentication. Instances with passkeys disabled or without the endpoint reachable from the internet are less exposed, but the sources do not say whether passkeys must be enabled for the endpoint to respond.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000769,"input_tokens":4712,"output_tokens":596,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-124432':12A,15A '-2026':11A,14A '/api/webauthn/prepare-login':82C '4.1.11':64C '4.1.9':62C '4.2.0':66C,71C 'account':9A,33B,54B,75C,94C,126C 'allowcredenti':107C 'apart':116C 'attack':6A,47B,104C 'base':41B 'beta.3':72C 'compar':49B,106C 'contain':73C 'credenti':30B,59B,88C,129C 'cve':10A,13A 'deriv':99C 'endpoint':4A,27B,83C 'enumer':7A,76C 'exist':8A,55B,122C 'fallback':42B,100C 'host':21B 'id':31B,43B,60B,89C,101C,108C,130C 'identifi':121C 'learn':52B 'let':5A 'limit':119C 'login':3A,26B 'md5':97C 'obtain':57B 'one':114C 'other':45B 'otherwis':102C 'packag':16B 'passkey':2A,25B,36B,92C,124C 'passkey-regist':91C,123C 'php':17B 'phpmyfaq':1A,18B,22B,61C 'post':81C 'pre':68C 'pre-releas':67C 'rate':118C 'regist':93C,125C 'releas':69C 'request':110C 'respons':50B 'return':28B,85C 'second':115C 'self':20B 'self-host':19B 'sent':111C 'stabl':29B,86C 'store':87C 'time':40B,98C 'time-bas':39B 'unauthent':24B,80C,103C 'vulner':77C 'without':117C","nicknames":[],"mitigations":[],"who_affected":"Any public phpMyFAQ instance on an affected version exposes the passkey login endpoint without authentication. Instances with passkeys disabled or without the endpoint reachable from the internet are less exposed, but the sources do not say whether passkeys must be enabled for the endpoint to respond.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["high","package","php","phpmyfaq","selfhosted"],"campaign_type":null,"search_a":"'-124432':12A,15A '-2026':11A,14A 'account':9A 'attack':6A 'cve':10A,13A 'endpoint':4A 'enumer':7A 'exist':8A 'let':5A 'login':3A 'passkey':2A 'phpmyfaq':1A","search_b":"'account':33B,54B 'attack':47B 'base':41B 'compar':49B 'credenti':30B,59B 'endpoint':27B 'exist':55B 'fallback':42B 'host':21B 'id':31B,43B,60B 'learn':52B 'login':26B 'obtain':57B 'other':45B 'packag':16B 'passkey':25B,36B 'php':17B 'phpmyfaq':18B,22B 'respons':50B 'return':28B 'self':20B 'self-host':19B 'stabl':29B 'time':40B 'time-bas':39B 'unauthent':24B","search_c":"'/api/webauthn/prepare-login':82C '4.1.11':64C '4.1.9':62C '4.2.0':66C,71C 'account':75C,94C,126C 'allowcredenti':107C 'apart':116C 'attack':104C 'beta.3':72C 'compar':106C 'contain':73C 'credenti':88C,129C 'deriv':99C 'endpoint':83C 'enumer':76C 'exist':122C 'fallback':100C 'id':89C,101C,108C,130C 'identifi':121C 'limit':119C 'md5':97C 'one':114C 'otherwis':102C 'passkey':92C,124C 'passkey-regist':91C,123C 'phpmyfaq':61C 'post':81C 'pre':68C 'pre-releas':67C 'rate':118C 'regist':93C,125C 'releas':69C 'request':110C 'return':85C 'second':115C 'sent':111C 'stabl':86C 'store':87C 'time':98C 'unauthent':80C,103C 'vulner':77C 'without':117C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-23T14:45:17+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124432","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124432","severity":null,"published_at":"2026-11-08T14:18:09+00:00","modified_at":"2026-11-08T14:18:09+00:00","first_seen_at":"2026-11-08T14:48:38+00:00","fetched_at":"2026-11-08T14:48:38+00:00","note":null}],"documents":[{"id":102048,"url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-2rvx-pqfw-q35r","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-23T14:45:17+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":102049,"url":"https://www.vulncheck.com/advisories/phpmyfaq-before-4.1.11-and-4.2.0-beta.3-account-enumeration-via-webauthn-prepare-login","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}