Advisory · CVE-2026-111911
Unauthenticated WebAuthn bypass in phpMyFAQ can take over any account
phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass in its WebAuthn registration endpoints that lets an unauthenticated attacker register a passkey on any account and log in, bypassing passwords and TOTP. CVSS 3.1 9.8.
- Vendor
- phpMyFAQ
- Product
- phpMyFAQ
- Identifier / CWE
- CVE-2026-111911
CWE-287 - Action timing
- Immediate
Explain it like I’m five
The passkey sign-up desk never checks who you are, so a stranger can register their own passkey on your account and then walk in as you.
- 01Victim account staged
An unauthenticated attacker picks a target username on a phpMyFAQ instance.
- 02Forged attestation sent
The attacker submits a forged fmt=none attestation to the WebAuthn registration endpoint, which attaches the credential without authentication or challenge validation.
- 03Passkey login
The attacker logs in with the newly registered passkey, bypassing the account password and TOTP.
What happened
The phpMyFAQ project disclosed CVE-2026-111911 for versions 4.0.0 before 4.1.9. Its WebAuthn registration endpoints attach credentials to any account without authentication or challenge validation (CWE-287). An attacker can stage a victim username, submit a forged fmt=none attestation to register a passkey, and then log in bypassing passwords and TOTP, for full account takeover.
Per the vendor affected data in the NVD record, 4.1.9 is the first unaffected release, so upgrading to 4.1.9 or later is the stated fix.
What to do
- Inventory phpMyFAQ instances, including staging, demo, and help-desk installs.
- Upgrade affected instances to 4.1.9 or later using the project release guidance.
- Restrict administrative and API access to trusted networks while remediation is underway.
- Hunt for WebAuthn registrations for accounts that did not request them, new passkeys on privileged accounts, and logins that skip password and TOTP steps. Review and remove passkeys you cannot attribute, and force password resets for administrative accounts.
- Verify the deployed version after updating, not just that an update ran.
Management note
An unauthenticated path to any account, including administrators, makes this a patch-today item. Treat existing passkey registrations as untrusted until each one is attributed to its account owner.