What’s Vulnerable › Vulnerabilities

CVE-2026-76214: phpMyFAQ before 4.1.7 WebAuthn Replay Attack via Challenge

• Severity: high (CVSS 7.4 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-08-19 · updated 2026-09-01
• Weakness: CWE-294

Description

phpMyFAQ before 4.1.7 fails to persist the WebAuthn login challenge generated by prepareForLogin, because neither WebAuthn controller saves the mutated key objects back to the database. At login the anti-replay comparison is skipped by its own null guard, allowing an attacker who captures a successful WebAuthn assertion to replay it indefinitely and authenticate as the user without any interaction or hardware key.

Affected products

• thorsten phpMyFAQ: before 4.1.7 — fixed in 4.1.7

How to fix

Upgrade to a fixed version: thorsten phpMyFAQ 4.1.7. Check the vendor advisory for mitigations.

References

• https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-f534-wv9g-wx2w
• https://www.vulncheck.com/advisories/phpmyfaq-before-webauthn-replay-attack-via-challenge

Get alerted when CVE-2026-76214 or the next vulnerability affects your stack