Threats tagged 'ghsa-f46v-r9r2-mgmc'

phpMyFAQ versions 4.1.9 prior to 4.1.11 and 4.2.0 pre-releases before 4.2.0-beta.3 have an account enumeration vulnerability in the unauthenticated POST /api/webauthn/prepare-login endpoint. This endpoint returns stable credential IDs for passkey-registered accounts but a fallback ID derived from md5(time()) for others. Attackers can exploit this behavior by sending requests more than one second apart and comparing allowCredentials IDs to identify existing passkey-registered accounts without authentication or rate limiting.