CVE-2026-111911

9.8Critical

Published 17 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash

9.8Critical

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: Full C/I/A compromise
Weakness: CWE-287

Impact

Unauthenticated remote attackers can take over any account, bypassing passwords and TOTP. They only need network access to the WebAuthn registration endpoint and a target username.

Root cause

WebAuthn registration endpoints do not authenticate requests or validate challenges, allowing arbitrary passkeys to be attached to any user account.

Affected systems

phpMyFAQ 4.0.0 before 4.1.9

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Fix & remediation

Upgrade phpMyFAQ to version 4.1.9 or later. If patching immediately is not possible, block or restrict access to WebAuthn registration endpoints at your reverse proxy or web server.

shell

$ composer update phpmyfaq/phpmyfaq

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints attach credentials to any account without authentication or challenge validation. Attackers can stage a victim username, submit a forged fmt=none attestation to register a passkey, then log in bypassing passwords and TOTP for account takeover.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-111911