CVE-2026-124432

The phpMyFAQ software versions 4.1.9 before 4.1.11 and 4.2.0 pre-releases before 4.2.0-beta.3 are vulnerable to an account enumeration vulnerability via the unauthenticated POST /api/webauthn/prepare-login endpoint. The root cause is that the endpoint returns stable stored credential IDs for acco...

FreeBSD : phpmyfaq -- multiple vulnerabilities (5cd347f3-d573-11f1-a2bb-50ebf6bdf8e9)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 5cd347f3-d573-11f1-a2bb-50ebf6bdf8e9 advisory. phpMyFAQ team reports: The WebAuthn prepare-login endpoint returns stable credential IDs for existing...

phpmyfaq -- multiple vulnerabilities

phpMyFAQ team reports: The WebAuthn prepare-login endpoint returns stable credential IDs for existing accounts with registered passkeys and rotating credential IDs for unknown accounts, so an unauthenticated attacker can enumerate user accounts and passkeys. Insufficient authorization checks allo...