phpMyFAQ: Authentication bypass via WebAuthn credential injection
Summary
phpMyFAQ's WebAuthn registration endpoints attach a passkey to an existing user account without checking that the requester owns the account and without validating the server-issued challenge. An unauthenticated remote attacker who knows a username, for example admin, can register their own key for that account and then log in as the victim, bypassing the password and TOTP two-factor authentication. This requires WebAuthn support to be enabled, which is a non-default setting.
Affected
- phpMyFAQ 4.0.0 up to and including 4.1.8 (CNA range: 4.0.0 before 4.1.9)
- Only installations with security.enableWebAuthnSupport set to true are affected
- Sources differ on the lower boundary; 4.0.x should be verified against the GHSA advisories
Fixed in
- Upgrade to phpMyFAQ 4.1.9 or later
Workaround
- No vendor workaround known.
- Disabling WebAuthn support (security.enableWebAuthnSupport = false) removes the vulnerable code path until the update is applied.
- Restrict network access to the instance and its admin area (third-party advice, does not replace patching).
Exploitation
- CISA SSVC: exploitation status PoC, automatable: yes, technical impact: total.
- The vendor advisory includes a scripted proof of concept.
- Not marked as known exploited at the time of research; not listed in CISA KEV.
Our recommendation
- Upgrade to phpMyFAQ 4.1.9 or later.
- Until patched, disable WebAuthn support or restrict access to the instance and its admin area.
- Review user accounts and registered passkeys for unknown entries, and check logs for passkey registrations not preceded by a login.
- If compromise is suspected, reset passwords, remove unknown passkeys and review administrator accounts.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Advisory GHSA-g6cq-6rqg-6c9p github.com
- GitHub Advisory GHSA-rg9h-f29v-xhxr github.com
- VulnCheck Advisory www.vulncheck.com
- VulDB CVE-2026-111911 vuldb.com
- CVElist CVE-2026-111911 vulners.com
- TheHackerWire CVE-2026-111911 www.thehackerwire.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 01:22.
Original description (NVD)
phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints attach credentials to any account without authentication or challenge validation. Attackers can stage a victim username, submit a forged fmt=none attestation to register a passkey, then log in bypassing passwords and TOTP for account takeover.
NVD references (4)
- https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-g6cq-6rqg-6c9p
- https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-rg9h-f29v-xhxr
- https://www.vulncheck.com/advisories/phpmyfaq-4.0.0-before-4.1.9-authentication-bypass-via-webauthn-credentia…
- https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-g6cq-6rqg-6c9p
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.