CVE-2026-111911

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-111911
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111911.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-111911
Related
GHSA (2)
  • GHSA-g6cq-6rqg-6c9p
  • GHSA-rg9h-f29v-xhxr
Published
2026-10-17T18:46:28Z
Modified
2026-10-18T10:45:21Z
Severity
  • 9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
phpMyFAQ 4.0.0 before 4.1.9 Authentication Bypass via WebAuthn Credential Injection
Details

phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints attach credentials to any account without authentication or challenge validation. Attackers can stage a victim username, submit a forged fmt=none attestation to register a passkey, then log in bypassing passwords and TOTP for account takeover.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-287"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111911.json"
}
References

Affected packages

Git / github.com/thorsten/phpmyfaq

Affected ranges

Type
GIT
Repo
https://github.com/thorsten/phpmyfaq
Events
Introduced
9bf3d792e67da3c04217002a9642fdf74ced9554
Fixed
ecd0de3cff20d4a06e8ad17eef7c22ef227f0af9
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "4.0.0"
        },
        {
            "fixed":  "4.1.9"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111911.json"