CVE-2026-111911 is a critical authentication bypass in phpMyFAQ 4.0.0 through 4.1.8: an unauthenticated attacker can register a passkey on any account and then log in as that user, skipping both the password and TOTP.
What Is It
The flaw is in phpMyFAQ's WebAuthn (passkey) registration endpoints. According to the NVD record, these endpoints attach credentials to any account without checking authentication or validating the challenge. An attacker stages a victim's username, then submits a forged attestation with fmt=none to register a passkey they control. They can then log in with that passkey.
The weakness is classified as CWE-287 (Improper Authentication). VulnCheck reported the issue and published the record on 2026-10-17. Its NVD status is currently "Deferred."
Why It Matters
The result is full account takeover. A passkey login skips the password and TOTP, so second-factor protection does not stop this attack.
VulnCheck scores the issue as critical:
- CVSS 3.1: 9.8 Critical (
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). It is network-reachable, low complexity, and needs no privileges or user interaction. - CVSS 4.0: 9.3 Critical, with high impact to confidentiality, integrity, and availability on the vulnerable system.
Exploitation status: CVE-2026-111911 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. The supplied data does not confirm active exploitation, and no exploit maturity is defined in the CVSS 4.0 metrics. Given the low attack complexity and the account-takeover impact, administrators should still treat this as urgent.
What's Vulnerable
- Vendor: thorsten
- Product: phpMyFAQ
- Affected: versions 4.0.0 up to but not including 4.1.9
- Unaffected: 4.1.9
The record lists no CPE entries.
Patch Status
The affected-version data lists phpMyFAQ 4.1.9 as unaffected. Administrators running any 4.x release before 4.1.9 should upgrade to 4.1.9 or later. Because this CVE is not in the KEV catalog, CISA has issued no required action or remediation deadline. Check the vendor's GitHub security advisories below for full remediation guidance.
Sources
- NVD: CVE-2026-111911
- phpMyFAQ GitHub Security Advisory GHSA-g6cq-6rqg-6c9p
- phpMyFAQ GitHub Security Advisory GHSA-rg9h-f29v-xhxr
- VulnCheck Advisory: phpMyFAQ 4.0.0 before 4.1.9 Authentication Bypass via WebAuthn Credential Injection
- CISA Known Exploited Vulnerabilities Catalog (not listed as of publication)