Observable Response Discrepancy in phpMyFAQ - #VU164481
Published: November 10, 2026
Vulnerability identifier: #VU164481
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-204
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to enumerate passkey-enabled accounts, disclose credential IDs, and disrupt passkey authentication.
The vulnerability exists due to observable response discrepancies between stable stored credential IDs and rotating fallback IDs, alongside unauthenticated challenge updates, in phpMyFAQ's WebAuthn login preparation when WebAuthn support is enabled and passkeys are registered. A remote attacker can send requests to POST /api/webauthn/prepare-login more than one second apart to identify passkey-enabled accounts by comparing credential IDs, or repeatedly overwrite login challenges to prevent successful passkey authentication.
Affected software
phpMyFAQ
Remediation
Install security update from vendor's website.
phpMyFAQ - update to 4.1.11