CVE-2026-111911

Summary

The vulnerability allows attackers to bypass authentication by registering WebAuthn passkeys for any user account without proper validation, enabling full account takeover without needing passwords or TOTP. This affects phpMyFAQ installations running version 4.0.0 through 4.1.8.

Exploitability

Exploitation is relatively straightforward requiring only a victim's username and ability to submit a forged attestation, with no prerequisites beyond access to the WebAuthn registration endpoint.

Blast radius

The impact could be widespread as attackers can gain full administrative access to any user account, potentially leading to complete system compromise through unauthorized database access and configuration changes.

Detection

Monitor for unusual WebAuthn registration attempts in authentication logs, particularly those with fmt=none attestation values that do not correspond to legitimate user sessions.

Prioritized remediation

Upgrade to phpMyFAQ version 4.1.9 or later to address this authentication bypass vulnerability.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.