Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.9
CVE-2026-111911: phpMyFAQ lets attackers log in without password
CVE-2026-111911 · published 1 day ago
Summary
Versions of phpMyFAQ from 4.0.0 up to 4.1.8 let a malicious user add a passkey to any account without proving they own it. This means an attacker could create a credential for a victim’s username and then sign in without needing the password or two‑factor code. Upgrade phpMyFAQ to version 4.1.9 or later, and apply any available security patches as soon as possible.
What to do
- Update thorsten phpmyfaq to version 4.1.9 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| thorsten | phpmyfaq | < 4.1.9 |
Original advisory text
phpMyFAQ 4.0.0 before 4.1.9 Authentication Bypass via WebAuthn Credential Injection
phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints attach credentials to any account without authentication or challenge validation. Attackers can stage a victim username, submit a forged fmt=none attestation to register a passkey, then log in bypassing passwords and TOTP for account takeover.
References
- https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-g6cq-6rqg-6c9p Vendor Advisory
- https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-rg9h-f29v-xhxr Vendor Advisory
- https://www.vulncheck.com/advisories/phpmyfaq-4.0.0-before-4.1.9-authentication-... Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-1119... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-111911 Vendor Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker full control (estimated)
Severity
9.9
Critical
Type
CWE-287Improper Authentication
Timeline
Published17 Oct 2026
Updated18 Oct 2026
First seen17 Oct 2026
Track software like this
Free during beta