Vulnerability · Published Aug 19, 2026 · Assigned by VulnCheck

CVE-2026-76214phpMyFAQ before 4.1.7 WebAuthn Replay Attack via Challenge

High 7.4

In plain English

A high-severity security flaw in phpMyFAQ from thorsten. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 34% of all known vulnerabilities).

Severity (CVSS 3.1)7.4High

Exploit odds (30 days)0.4%top 66.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

phpMyFAQ before 4.1.7 fails to persist the WebAuthn login challenge generated by prepareForLogin, because neither WebAuthn controller saves the mutated key objects back to the database. At login the anti-replay comparison is skipped by its own null guard, allowing an attacker who captures a successful WebAuthn assertion to replay it indefinitely and authenticate as the user without any interaction or hardware key.

Affected products (as reported)

Vendor	Product	Versions
thorsten	phpMyFAQ	0 – before 4.1.7

Weakness: CWE-294 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

References

GitHub Security Advisory (GHSA-f534-wv9g-wx2w) vendor-advisory
VulnCheck Advisory: phpMyFAQ before 4.1.7 WebAuthn Replay Attack via Challenge third-party-advisory