CVE-2026-111911: Improper Authentication in thorsten phpMyFAQ

CVE-2026-111911 describes an authentication bypass vulnerability in phpMyFAQ versions >=4.0.0 and <4.1.9. The vulnerability arises because the WebAuthn registration endpoints accept credentials and attach them to user accounts without performing proper authentication or challenge validation. An attacker can exploit this by staging a victim's username and submitting a forged fmt=none attestation to register a passkey. This bypasses normal authentication mechanisms such as passwords and TOTP, enabling the attacker to take over the victim's account.

Successful exploitation allows an unauthenticated attacker to bypass all authentication controls and take over any user account by registering a forged passkey. This compromises account confidentiality and integrity, enabling unauthorized access and potential misuse of the victim's privileges within phpMyFAQ.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.