Description

phpMyFAQ before 4.1.7 (affected versions <= 4.1.5) fails to persist the WebAuthn login challenge generated by prepareForLogin, because neither WebAuthn controller saves the mutated key objects back to the database. At login the anti-replay comparison is skipped by its own null guard, allowing an attacker who captures a successful WebAuthn assertion to replay it indefinitely and authenticate as the user without any interaction or hardware key.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-08-19T14:17:47.473Z",
  "pubdate": "2026-08-19T14:17:47.473Z",
  "executiveSummary": "An authentication bypass vulnerability exists in phpMyFAQ prior to version 4.1.7 (affecting versions <= 4.1.5) involving the WebAuthn authentication mechanism.\nThe vulnerability stems from a failure to persist the WebAuthn login challenge generated by the prepareForLogin function, as the WebAuthn controllers do not save the mutated key objects back to the database.\nConsequently, during the login sequence, the anti-replay challenge comparison is entirely bypassed due to its own null guard evaluation.\nThis flaw allows a malicious actor who captures a previously successful WebAuthn assertion to replay the cryptographic payload indefinitely.\nSuccessful exploitation grants the attacker the ability to authenticate as the target user without requiring any physical interaction, cryptographic seed validation, or possession of the associated hardware security key.\nThe impact includes complete account takeover, unauthorized access to sensitive knowledge base functionalities, and potential privilege escalation depending on the targeted user profile.\nThe risk implication is critical, as it completely subverts the security guarantees typically provided by multi-factor WebAuthn hardware tokens.\nNo special privileges are required by the attacker other than the ability to intercept a legitimate authentication assertion over the network.",
  "technicalDetails": "The root cause of this vulnerability lies in the state management implementation within the WebAuthn authentication workflow of phpMyFAQ.\nDuring the initial authentication phase executed via the prepareForLogin function, a cryptographic WebAuthn login challenge is dynamically generated.\nHowever, the WebAuthn controllers fail to persist these mutated key objects back into the underlying database backend.\nBecause the challenge state is lost and never stored for subsequent validation, the server-side verification logic encounters a null value during the final login validation step.\nAn improper null guard condition within the anti-replay comparison logic evaluates this missing state and bypasses the challenge-response verification entirely rather than failing securely.\nThe exploitation method relies on passive network monitoring or interception techniques to capture a valid WebAuthn assertion payload transmitted during a legitimate user authentication session.\nThe step-by-step attack flow proceeds as follows: First, a legitimate user initiates and completes a WebAuthn login, generating a valid cryptographic assertion. Second, an attacker intercepts this assertion payload in transit. Third, the attacker subsequently submits the captured assertion payload to the phpMyFAQ authentication endpoint independently of the original session. Fourth, because the server fails to persist the challenge, the anti-replay check is bypassed via the null guard. Fifth, the application accepts the replayed assertion as valid, issuing an authenticated session token to the attacker.\nThe vulnerable components include the WebAuthn controller classes and the state management logic handling the prepareForLogin method.\nAffected software versions include phpMyFAQ <= 4.1.5, prior to version 4.1.7.\nNetwork exposure is remote, as the authentication interface is accessible via standard web protocols.\nNo authentication or hardware tokens are required by the attacker during the replay phase, as the security mechanism itself is structurally bypassed.\nThe post-exploitation impact allows the adversary to maintain persistent, unauthorized access to the victim's account, potentially compromising administrative privileges within the phpMyFAQ deployment."
}