phpMyFAQ Critical Auth Bypass Lets Attackers Take Over Accounts

Unauthenticated attackers can seize full control of phpMyFAQ user accounts by exploiting a critical authentication bypass flaw in the software. The vulnerability, tracked as CVE-2026-111911, allows malicious actors to register passkeys for any existing account without providing valid credentials or passing challenge validation checks.

The flaw resides in the WebAuthn registration endpoints of phpMyFAQ versions 4.0.0 through 4.1.8. According to the National Vulnerability Database record, these endpoints attach credentials to accounts without verifying the user's identity. This lack of validation enables attackers to stage a victim's username and submit a forged attestation to register a new passkey.

Technical Details of the Vulnerability

The exploit mechanism relies on the ability to submit a forged fmt=none attestation during the passkey registration process. By doing so, attackers can bypass standard password requirements and time-based one-time password (TOTP) protections entirely. Once the passkey is registered, the attacker can log in to the target account, effectively achieving full account takeover.

The Common Weakness Enumeration categorizes this issue as CWE-287, which denotes an improper authentication mechanism. The National Vulnerability Database assigns a CVSS score of 9.3, classifying the severity as Critical. This high score reflects the ease of exploitation and the severe impact of unauthorized access to user accounts.

Affected Versions and Context

The vulnerability affects phpMyFAQ, a popular open-source FAQ system developed by Thorsten. All versions from 4.0.0 up to, but not including, 4.1.9 are impacted by this flaw. Users running any version in this range face immediate risk if their installation is exposed to the internet or accessible to untrusted networks.

This incident follows a series of high-severity authentication bypasses reported recently in other web applications. As Threat Times reported on 2026-10-16, Webreaper Damselfly 4.5.3 contained a critical flaw allowing full admin control via exposed API routes. Similarly, FastapiAdmin 3.0 was found to have unprotected auto-login endpoints that allowed attackers to mint superuser tokens.

These recent disclosures highlight a persistent trend in web application security where authentication logic is insufficiently protected. While phpMyFAQ's issue involves WebAuthn specifically, the underlying problem remains the same: endpoints that modify account state without rigorous identity verification.

What should you do?

Administrators managing phpMyFAQ installations should immediately verify their current version against the affected range. If running version 4.0.0 through 4.1.8, the system is vulnerable to unauthenticated account takeover. Organizations should restrict network access to the application if an immediate update is not possible, limiting exposure to trusted internal networks only.

Monitoring authentication logs for unusual passkey registration activity can help detect exploitation attempts. Look for new passkey registrations from unexpected IP addresses or for accounts that have not recently interacted with the system. Investigating these anomalies early may prevent successful account compromise.