Missing Authentication for Critical Function in phpMyFAQ - #VU164487
Published: November 10, 2026
Vulnerability identifier: #VU164487
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: N/A
CWE-ID: CWE-306
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to take over accounts with known usernames, including administrator accounts, bypassing passwords and TOTP authentication.
The vulnerability exists due to missing authentication and challenge validation in phpMyFAQ's WebAuthn registration endpoints when WebAuthn support is enabled. A remote attacker can obtain an anonymous CSRF token, stage a victim's username through /api/webauthn/prepare, and submit a fabricated fmt=none attestation to /api/webauthn/register to attach an attacker-controlled credential and log in as the victim.
Affected software
phpMyFAQ
Remediation
Install security update from vendor's website.
phpMyFAQ - update to 4.1.9