Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
phpMyFAQ 4.0.0 before 4.1.9 contains an authentication bypass vulnerability where WebAuthn registration endpoints attach credentials to any account without authentication or challenge validation. Attackers can stage a victim username, submit a forged fmt=none attestation to register a passkey, then log in bypassing passwords and TOTP for account takeover.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
phpMyFAQ just got a 9.8 (CVE-2026-111911): WebAuthn enrollment works without a session, skips the challenge check and accepts fmt=none. Know a username, add your own passkey, log in. Password and TOTP never come up. Who tests passkey enrollment, not just login? #AppSec
🔐🔓 phpMyFAQ — 9 CVEs, patch to 4.1.9 now CVE-2026-111911 (9.8): WebAuthn auth bypass — unauthenticated attacker registers a passkey on any account using a forged fmt=none attestation. 🔗 https://threataft.com/articles/phpmyfaq-cluster-cve-2026-111911-111882-111884-111908-111909-111898-111901-111897-111907 #phpMyFAQ #WebAuthn #CVE #CyberSecurity #ThreatIntel
phpMyFAQ 4.1.8以下でWebAuthnを有効にしていると、認証なしで他人のアカウントに鍵を足され、パスワードも二要素も通らずに乗っ取られる恐れ。CVSS 9.8。4.1.9で修正済みです。 https://cve.autoarticles.net/cve/CVE-2026-111911
phpMyFAQ's passkey registration attached a credential to any account without authenticating, so WebAuthn became the way past both the password and TOTP. No exploitation reported. https://severitydaily.com/phpmyfaq-cve-2026-111911-webauthn-fmt-none-registration-auth-bypass-9-8-28-records-4-1-9/