CVE-2026-76214

9.1 criticalEPSS 0.4%

Critical (9.1) in phpmyfaq phpmyfaq. EPSS 0.4% chance of exploitation in the next 30 days.

phpMyFAQ before 4.1.7 fails to persist the WebAuthn login challenge generated by prepareForLogin, because neither WebAuthn controller saves the mutated key objects back to the database. At login the anti-replay comparison is skipped by its own null guard, allowing an attacker who captures a successful WebAuthn assertion to replay it indefinitely and authenticate as the user without any interaction or hardware key.

Severity

CVSS 4.0

9.1 critical

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

CVSS 3.1

7.4 high

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 33% of CVEs (scores of 2026-10-31)
CWE: CWE-294
Published: 2026-08-19
Modified: 2026-09-01
Record from: the NVD, synced 2026-10-19

Affected

phpmyfaq:phpmyfaq

References

https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-f534-wv9g-wx2w
https://www.vulncheck.com/advisories/phpmyfaq-before-webauthn-replay-attack-via-challenge

Check your stack JSON