CVE-2026-76214

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.7

Description The software fails to persist the WebAuthn login challenge generated by the prepareForLogin() function because the WebAuthn controller does not save the mutated key objects back to the database. During the login process, the anti-replay comparison is bypassed by a null guard. This allows an attacker who captures a successful WebAuthn assertion to replay it indefinitely to authenticate as a user without requiring interaction or a hardware key.

Recommendations Update to version 4.1.7 or later.