phpMyFAQ WebAuthn Bypass Allows Unauthenticated Account Takeover

phpMyFAQ contains a critical authentication bypass vulnerability that enables attackers to take over user accounts without valid credentials. The flaw exists in the WebAuthn registration endpoints, which fail to verify the identity of the requester or validate cryptographic challenges. This allows an attacker to attach a new passkey to any account name they know, effectively locking out the legitimate user and gaining full access to the account.

Root cause

The vulnerability stems from insufficient validation in the WebAuthn registration process. According to the National Vulnerability Database, the endpoints do not require authentication before processing registration requests. Furthermore, the system does not validate the cryptographic challenge associated with the registration. This lack of checks means that an attacker can submit a forged attestation using the `fmt=none` format, which the system accepts as valid, allowing the credential to be linked to the target account.

Attack path

An attacker begins by identifying a valid username within a phpMyFAQ installation. They then submit a registration request to the WebAuthn endpoint, attaching a forged credential using a `fmt=none` attestation. Because the endpoint does not authenticate the request or validate the challenge, it accepts the new passkey. The attacker can then use this registered passkey to log in, bypassing both password and TOTP verification mechanisms. This results in complete account takeover for the targeted user.

Affected versions

• phpMyFAQ 4.0.0
• phpMyFAQ 4.0.1
• phpMyFAQ 4.0.2
• phpMyFAQ 4.0.3
• phpMyFAQ 4.0.4
• phpMyFAQ 4.0.5
• phpMyFAQ 4.0.6
• phpMyFAQ 4.0.7
• phpMyFAQ 4.0.8
• phpMyFAQ 4.1.0
• phpMyFAQ 4.1.1
• phpMyFAQ 4.1.2
• phpMyFAQ 4.1.3
• phpMyFAQ 4.1.4
• phpMyFAQ 4.1.5
• phpMyFAQ 4.1.6
• phpMyFAQ 4.1.7
• phpMyFAQ 4.1.8

Mitigation

• Upgrade phpMyFAQ to version 4.1.9 or later immediately.
• Disable WebAuthn registration endpoints if upgrading is not immediately possible.
• Monitor authentication logs for unusual passkey registration activity.
• Enforce strict access controls on administrative interfaces.

Signals worth monitoring

Security teams should monitor authentication logs for unexpected passkey registration events, especially those originating from unfamiliar IP addresses or user agents. Look for rapid sequences of registration attempts for multiple accounts, which may indicate automated exploitation. Check for successful logins using newly registered passkeys shortly after creation, as this suggests active abuse. If anomalies are detected, isolate affected systems, revoke suspicious credentials, and force password resets for compromised accounts to contain the breach.

Background: Account takeover

Account takeover fraud occurs when attackers hijack your credentials to access personal or financial services. They use stolen data, social engineering, or weak security questions to bypass defenses. You stop this by enforcing hardware-based multi-factor authentication, monitoring session logs, and treating password resets as the highest-risk activity.

Read the full guide: Account Takeover Fraud: How Attackers Steal Identities and How You Stop It

What to do and how to stay safe

• Verify your phpMyFAQ version and upgrade to 4.1.9 if you are running an earlier release.
• Review authentication logs for unauthorized passkey registrations or unusual login patterns.
• Temporarily disable WebAuthn registration if you cannot patch immediately.
• Force password resets for any accounts that show signs of unauthorized access.

Step-by-step guide: Attack Surface Management: 6 Common Misreadings and Correct Views

General security guidance from the NetSec Observer newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

What is CVE-2026-111911?

It is a critical authentication bypass vulnerability in php