phpMyFAQ CVE-2026-111911

Exploitation requires that the target runs phpMyFAQ in the affected range (4.0.0 up to but not including 4.1.9) with the WebAuthn/passkey registration endpoints reachable by the attacker - these endpoints attach credentials to any account without authentication or challenge validation, which is the core defect. The attacker must know or supply a valid target username to 'stage' it, and must submit a forged fmt=none ('none' attestation format) WebAuthn attestation. No password, TOTP, existing session, or user interaction is required (PR:N/UI:N), and the attack works against affected versions without special non-default configuration beyond WebAuthn being present. The practical limiting factors are: the instance must be reachable over the network, WebAuthn registration must be exposed, and the deployment must not yet be upgraded to 4.1.9 or later.

This is a genuine high-priority vulnerability, not an inflated-CVSS artifact. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a remote, low-complexity attack requiring no privileges and no user interaction, with high impact to confidentiality, integrity, and availability of the vulnerable system (VC:H/VI:H/VA:H) - fully consistent with the CWE-287 authentication-bypass description leading to account takeover. The flaw is especially serious because it defeats both password and TOTP second factors, collapsing an entire authentication stack via WebAuthn credential injection. However, several corroborating signals are ABSENT from the provided data: there is no EPSS score, no CISA KEV listing, and no indication of public POC code, so no public exploit identified at time of analysis. No SSVC decision data (exploitation status, automatable, technical impact) was supplied either. The vulnerability was reported by VulnCheck and documented in two GitHub Security Advisories, which lends high confidence to the technical validity, but the real-world exploitation signal is currently unmeasured rather than low - the missing EPSS/KEV data should not be read as evidence of low risk. Priority should be driven by the unauthenticated-takeover nature of the bug and patch availability, not by exploitation telemetry that is simply not present in this dataset.

A remote, unauthenticated attacker targets an internet-facing phpMyFAQ instance (4.0.0 up to before 4.1.9), stages a victim's username at the WebAuthn registration endpoint, and submits a forged fmt=none attestation to bind an attacker-controlled passkey to that account without any challenge validation. The attacker then authenticates with their passkey, bypassing the victim's password and TOTP, and takes over the account - including administrative accounts. No public exploit code was identified in the provided data, but the attestation forgery is straightforward and requires no special tooling.