CVE-2026-27836

HIGH
2026-02-27 [email protected] GHSA-w22q-m2fm-x9f4
7.5
CVSS 3.1
Share

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None

Lifecycle Timeline

4
Analysis Generated
Mar 12, 2026 - 21:55 vuln.today
PoC Detected
Mar 04, 2026 - 16:08 vuln.today
Public exploit code
Patch Released
Mar 04, 2026 - 16:08 nvd
Patch available
CVE Published
Feb 27, 2026 - 20:21 nvd
HIGH 7.5

Tags

CSRF Phpmyfaq

Description

phpMyFAQ is an open source FAQ web application. Prior to version 4.0.18, the WebAuthn prepare endpoint (`/api/webauthn/prepare`) creates new active user accounts without any authentication, CSRF protection, captcha, or configuration checks. This allows unauthenticated attackers to create unlimited user accounts even when registration is disabled. Version 4.0.18 fixes the issue.

Analysis

Unauthenticated account creation in phpMyFAQ versions before 4.0.18 allows remote attackers to register unlimited user accounts through the WebAuthn prepare endpoint without authentication, CSRF protection, or captcha validation, even when registration is disabled. Public exploit code exists for this vulnerability. …

Sign in for full analysis, threat intelligence, and remediation guidance.

Remediation

Within 24 hours: Identify all phpMyFAQ instances and their versions; disable the `/api/webauthn/prepare` endpoint if immediate patching is impossible. Within 7 days: Apply vendor patch to upgrade phpMyFAQ to version 4.0.18 or later across all instances. …

Sign in for detailed remediation steps.

Full analysis requires sign-in

Get intelligence summaries, risk assessment, exploit details, threat intel, and remediation guidance.

Sign in - Free

Priority Score

58
Low Medium High Critical
KEV: 0
EPSS: +0.0
CVSS: +38
POC: +20

Share

CVE-2026-27836 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy