What is the CVSS score of CVE-2026-27836?

CVE-2026-27836 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Phpmyfaq are affected by CVE-2026-27836?

A critical authentication bypass vulnerability in phpMyFAQ versions prior to 4.0.18 allows attackers to create unauthorized user accounts without any security controls, potentially giving threat…. A patch is available.

Is there a public PoC exploit available for CVE-2026-27836?

Yes, a public proof-of-concept exploit is available for CVE-2026-27836. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-27836?

Within 24 hours: Identify all phpMyFAQ instances and their versions; disable the `/api/webauthn/prepare` endpoint if immediate patching is impossible. Within 7 days: Apply vendor patch to upgrade phpMyFAQ to version 4.0.18 or later across all instances. Within 30 days: Conduct security audit of account creation logs to identify any unauthorized accounts created during the vulnerability window and review access controls.

Phpmyfaq CVE-2026-27836

HIGH

Missing Authorization (CWE-862)

2026-02-27 security-advisories@github.com

GHSA-w22q-m2fm-x9f4

CSRF Phpmyfaq

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Mar 04, 2026 - 16:08 vuln.today

Public exploit code

Patch released

Mar 04, 2026 - 16:08 nvd

Patch available

CVE Published

Feb 27, 2026 - 20:21 nvd

HIGH 7.5

DescriptionGitHub Advisory

phpMyFAQ is an open source FAQ web application. Prior to version 4.0.18, the WebAuthn prepare endpoint (/api/webauthn/prepare) creates new active user accounts without any authentication, CSRF protection, captcha, or configuration checks. This allows unauthenticated attackers to create unlimited user accounts even when registration is disabled. Version 4.0.18 fixes the issue.

AnalysisAI

Unauthenticated account creation in phpMyFAQ versions before 4.0.18 allows remote attackers to register unlimited user accounts through the WebAuthn prepare endpoint without authentication, CSRF protection, or captcha validation, even when registration is disabled. Public exploit code exists for this vulnerability. Update to version 4.0.18 or later to remediate.

Technical ContextAI

Classified as CWE-862 (Missing Authorization). Affects Phpmyfaq. phpMyFAQ is an open source FAQ web application. Prior to version 4.0.18, the WebAuthn prepare endpoint (/api/webauthn/prepare) creates new active user accounts without any authentication, CSRF protection, captcha, or configuration checks. This allows unauthenticated attackers to create unlimited user accounts even when registration is disabled. Version 4.0.18 fixes the issue.