CVE-2026-124432
Deferred Deferred - Pending Action

phpMyFAQ Account Enumeration via Passkey Login API

Publication date: 2026-11-08

Last updated on: 2026-11-08

Assigner: VulnCheck

Description
phpMyFAQ 4.1.9 before 4.1.11 and 4.2.0 pre-releases before 4.2.0-beta.3 contain an account enumeration vulnerability in the unauthenticated POST /api/webauthn/prepare-login endpoint, which returns stable stored credential IDs for passkey-registered accounts but an md5(time())-derived fallback ID otherwise. Unauthenticated attackers can compare allowCredentials IDs from requests sent more than one second apart, without rate limiting, to identify existing passkey-registered accounts and their credential IDs.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-08
Last Modified
2026-11-08
Generated
2026-11-08
AI Q&A
2026-11-08
EPSS Evaluated
N/A
NVD
CVE-2026-124432
EUVD
EUVD-2026-119568

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
phpmyfaq phpmyfaq to 4.1.11 (exc)
phpmyfaq phpmyfaq to 4.2.0-beta.3 (exc)
phpmyfaq phpmyfaq From 4.1.9 (inc) to 4.2.0-beta.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-204 The product provides different responses to incoming requests in a way that reveals internal state information to an unauthorized actor outside of the intended control sphere.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an account enumeration issue in phpMyFAQ versions before 4.1.11 and 4.2.0-beta.3. It exists in the unauthenticated POST /api/webauthn/prepare-login endpoint. The endpoint returns stable credential IDs for accounts with registered passkeys but generates a time-based synthetic ID for non-existent users or those without passkeys. Attackers can send two requests for the same username more than one second apart and compare the credential IDs to determine if the account exists and has a passkey.

Detection Guidance

To detect this vulnerability, monitor POST requests to /api/webauthn/prepare-login. Send two requests for the same username more than one second apart and compare the allowCredentials IDs. Stable IDs indicate passkey-registered accounts, while time-based IDs suggest non-existent or non-passkey accounts.

Impact Analysis

Unauthenticated attackers can identify existing accounts with registered passkeys. This could lead to targeted phishing attacks, credential stuffing, or disruption of legitimate login attempts. The vulnerability also modifies stored passkey challenges for queried accounts, potentially causing login failures for legitimate users.

Compliance Impact

This vulnerability may violate GDPR and HIPAA by exposing user account information without authentication, compromising confidentiality. It could lead to unauthorized access to sensitive data if combined with other exploits, potentially resulting in non-compliance with data protection requirements.

Mitigation Strategies

Upgrade phpMyFAQ to versions 4.1.11 or later for the 4.1.x branch, or 4.2.0-beta.3 or later for the 4.2.x branch. Disable the security.enableWebAuthnSupport option if not required. Implement rate limiting and CSRF protection on the /api/webauthn/prepare-login endpoint.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-124432. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...