CVE-2026-27836 | BDVDB-2026-317739 Detail

Description#

phpMyFAQ is an open source FAQ web application. Prior to version 4.0.18, the WebAuthn prepare endpoint (`/api/webauthn/prepare`) creates new active user accounts without any authentication, CSRF protection, captcha, or configuration checks. This allows unauthenticated attackers to create unlimited user accounts even when registration is disabled. Version 4.0.18 fixes the issue.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-02-27Record published in the CVE List.
2. Version 22026-03-03Most recent update recorded in the CVE List.