CVE-2026-124432

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions 4.1.9 through 4.1.10 phpMyFAQ versions 4.2.0 through 4.2.0-beta.2

Description An account enumeration issue exists in the unauthenticated POST '/api/webauthn/prepare-login' endpoint. The system returns stable stored credential IDs for accounts registered with passkeys, while returning a fallback ID derived from md5(time()) for others. Because there is no rate limiting, unauthenticated attackers can compare allowCredentials IDs from requests sent more than one second apart to identify existing passkey-registered accounts and their associated credential IDs.

Recommendations Update phpMyFAQ versions 4.1.9 through 4.1.10 to version 4.1.11. Update phpMyFAQ versions 4.2.0 through 4.2.0-beta.2 to version 4.2.0-beta.3.