What is the CVSS score of CVE-2026-27836?

CVE-2026-27836 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of Phpmyfaq are affected by CVE-2026-27836?

A critical authentication bypass vulnerability in phpMyFAQ versions prior to 4.0.18 allows attackers to create unauthorized user accounts without any security controls, potentially giving threat…. A patch is available.

Is there a public PoC exploit available for CVE-2026-27836?

Yes, a public proof-of-concept exploit is available for CVE-2026-27836. Prioritise patching immediately. EPSS: 0.0%.

How to fix or mitigate CVE-2026-27836?

Within 24 hours: Identify all phpMyFAQ instances and their versions; disable the `/api/webauthn/prepare` endpoint if immediate patching is impossible. Within 7 days: Apply vendor patch to upgrade phpMyFAQ to version 4.0.18 or later across all instances. Within 30 days: Conduct security audit of account creation logs to identify any unauthorized accounts created during the vulnerability window and review access controls.

Phpmyfaq CVE-2026-27836

HIGH

Missing Authorization (CWE-862)

2026-02-27 security-advisories@github.com

GHSA-w22q-m2fm-x9f4

CSRF Phpmyfaq

7.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:55 vuln.today

PoC Detected

Mar 04, 2026 - 16:08 vuln.today

Public exploit code

Patch released

Mar 04, 2026 - 16:08 nvd

Patch available

CVE Published

Feb 27, 2026 - 20:21 nvd

HIGH 7.5

DescriptionGitHub Advisory

phpMyFAQ is an open source FAQ web application. Prior to version 4.0.18, the WebAuthn prepare endpoint (/api/webauthn/prepare) creates new active user accounts without any authentication, CSRF protection, captcha, or configuration checks. This allows unauthenticated attackers to create unlimited user accounts even when registration is disabled. Version 4.0.18 fixes the issue.

AnalysisAI

Unauthenticated account creation in phpMyFAQ versions before 4.0.18 allows remote attackers to register unlimited user accounts through the WebAuthn prepare endpoint without authentication, CSRF protection, or captcha validation, even when registration is disabled. Public exploit code exists for this vulnerability. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Send POST request to /api/webauthn/prepare endpoint

Exploit

Provide new user credentials in request

Execution

Endpoint creates active user account without validation

Impact

Attacker gains unauthorized account access

Access

Send POST request to /api/webauthn/prepare endpoint

Exploit

Provide new user credentials in request

Execution

Endpoint creates active user account without validation

Impact

Attacker gains unauthorized account access

Vulnerability AssessmentAI

Exploitation	phpMyFAQ versions prior to 4.0.18 with WebAuthn prepare endpoint exposed. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	CVSS 7.5 (HIGH). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An attacker without authentication could exploit this vulnerability to create unlimited user accounts even when registration is disabled.
Remediation	A vendor patch is available — apply it immediately. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours: Identify all phpMyFAQ instances and their versions; disable the /api/webauthn/prepare endpoint if immediate patching is impossible. …

Threat intelligence, references, and detailed analysis are available after sign-in.

CVE-2026-27836 vulnerability details – vuln.today

Back

Phpmyfaq CVE-2026-27836

Severity by source

CVSS VectorGitHub Advisory

Lifecycle Timeline

DescriptionGitHub Advisory

AnalysisAI

Unlock full vulnerability intelligence

Attack ChainAIDerived

Vulnerability AssessmentAI

Recommended ActionAI

Share

External POC / Exploit Code