CVE-2026-27836CWE-862

phpMyFAQ Allows Unauthenticated Account Creation via WebAuthn Prepare Endpoint

High · published February 27, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
42.2
In the wild
Unconfirmed
What it is

phpMyFAQ is an open source FAQ web application. Prior to version 4.0.18, the WebAuthn prepare endpoint (`/api/webauthn/prepare`) creates new active user accounts without any authentication, CSRF protection, captcha, or configuration checks. This allows unauthenticated attackers to create unlimited user accounts even when registration is disabled. Version 4.0.18 fixes the issue.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00505 · 42.2th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-02-27T19:54Z
EPSS history
Timeline
  • 27 FEB 19:54Z
    phpMyFAQ Allows Unauthenticated Account Creation via WebAuthn Prepare Endpoint
    cvelistv5