CVE-2026-27836

The record

phpMyFAQ is an open source FAQ web application. Prior to version 4.0.18, the WebAuthn prepare endpoint (`/api/webauthn/prepare`) creates new active user accounts without any authentication, CSRF protection, captcha, or configuration checks. This allows unauthenticated attackers to create unlimited user accounts even when registration is disabled. Version 4.0.18 fixes the issue.

Affected packages

Related vulnerabilities

• GHSA-w22q-m2fm-x9f4 phpMyFAQ Allows Unauthenticated Account Creation via WebAuthn Prepare Endpoint Same vulnerability
• CVE-2026-24420 phpMyFAQ: Attachment download allowed without dlattachment right (broken access control) Also affects thorsten/phpmyfaq
• CVE-2026-24421 phpMyFAQ: /api/setup/backup accessible to any authenticated user (authz missing) Also affects thorsten/phpmyfaq
• CVE-2026-24422 phpMyFAQ: Public API endpoints expose emails and invisible questions Also affects thorsten/phpmyfaq
• GHSA-9cg9-4h4f-j6fg phpMyFAQ has unauthenticated config backup download via /api/setup/backup Also affects thorsten/phpmyfaq
• CVE-2025-69200 phpMyFAQ has unauthenticated config backup download via /api/setup/backup Also affects thorsten/phpmyfaq
• GHSA-jv8r-hv7q-p6vc phpMyFAQ has Stored XSS in user list via admin-managed display_name Also affects thorsten/phpmyfaq
• CVE-2025-68951 phpMyFAQ has Stored XSS in user list via admin-managed display_name Also affects thorsten/phpmyfaq