CVE-2026-76214: phpMyFAQ Authentication Bypass Vulnerability

CVE-2026-76214 Overview

CVE-2026-76214 is a critical authentication vulnerability in phpMyFAQ versions before 4.1.7. The flaw resides in the WebAuthn login flow, where the challenge generated by prepareForLogin is never persisted to the database. Neither WebAuthn controller writes the mutated key objects back after challenge generation, leaving the stored challenge null.

During login, the anti-replay comparison is bypassed by a null guard that assumes a missing challenge means no check is required. An attacker who captures a single successful WebAuthn assertion can replay it indefinitely to authenticate as the victim. No user interaction or hardware security key is required after capture.

Critical Impact
Captured WebAuthn assertions can be replayed to hijack accounts without possession of the hardware authenticator, defeating the phishing-resistant guarantees WebAuthn is intended to provide.

Affected Products

phpMyFAQ versions prior to 4.1.7
phpMyFAQ WebAuthn login controllers
Deployments using WebAuthn as a second-factor or passwordless authentication method

Discovery Timeline

2026-08-19 - CVE-2026-76214 published to NVD
2026-08-21 - Last updated in NVD database

Technical Details for CVE-2026-76214

Vulnerability Analysis

The vulnerability is classified under [CWE-294] Authentication Bypass by Capture-Replay. WebAuthn is designed to prevent replay attacks by binding each authentication ceremony to a server-generated challenge that must be unique and single-use. The relying party generates a challenge, stores it, and later verifies that the assertion returned by the authenticator references that exact challenge.

In phpMyFAQ, prepareForLogin correctly generates a fresh challenge and mutates the in-memory key object. However, neither WebAuthn controller calls the persistence layer to save the mutated object. The challenge is discarded when the request ends.

On the subsequent login request, the server retrieves the key record and finds a null challenge value. Rather than treating this as an error, the verification logic contains a null guard that skips the anti-replay comparison entirely. Any previously observed valid assertion for that user passes verification.

Root Cause

The root cause is missing state persistence combined with a permissive null check. The controller code that issues the challenge does not invoke the repository save operation. The verifier then interprets the absence of a stored challenge as an instruction to bypass replay protection rather than as a fatal condition.

Attack Vector

An attacker must first observe a legitimate WebAuthn authentication assertion. This can be achieved through network interception on non-HTTPS deployments, a compromised proxy, malicious browser extensions, or server-side log exposure. Once captured, the attacker replays the assertion payload against the phpMyFAQ login endpoint.

Because the stored challenge is null on every login attempt, the same assertion authenticates the attacker as the victim on every replay. The attack requires no interaction with the legitimate user and no access to the physical authenticator. Refer to the GitHub Security Advisory and the VulnCheck Advisory for further technical detail.

Detection Methods for CVE-2026-76214

Indicators of Compromise

Repeated successful WebAuthn login events for the same user with identical assertion signatures or clientDataJSON values.
Successful authentications originating from IP addresses or user agents inconsistent with the user's baseline.
Database records where WebAuthn key challenge fields remain null after login attempts.

Detection Strategies

Instrument the WebAuthn controllers to log the raw assertion payload hash for each successful login and alert on duplicates.
Correlate application login logs with network flow data to identify replayed sessions from new source addresses.
Audit the faqauth or equivalent WebAuthn tables for null challenge values immediately following a login request.

Monitoring Recommendations

Forward phpMyFAQ web server and application logs to a centralized analytics platform for cross-session correlation.
Alert on administrative account logins that occur outside expected geolocations or time windows.
Track authentication anomalies such as impossible travel and concurrent sessions for accounts using WebAuthn.

How to Mitigate CVE-2026-76214

Immediate Actions Required

Upgrade phpMyFAQ to version 4.1.7 or later on all instances that expose the administrative interface.
Invalidate existing WebAuthn sessions and force users to re-authenticate after upgrading.
Review authentication logs for the past 90 days to identify potential replayed assertions.

Patch Information

The maintainers fixed the issue in phpMyFAQ 4.1.7 by persisting the mutated WebAuthn key object after prepareForLogin generates the challenge and by removing the permissive null guard in the verifier. Details are available in the GitHub Security Advisory GHSA-f534-wv9g-wx2w.

Workarounds

Disable WebAuthn authentication in the phpMyFAQ administrative configuration until the patch is applied.
Restrict access to the phpMyFAQ admin interface to trusted networks or VPN clients using web server access controls.
Enforce TLS on all phpMyFAQ traffic to reduce the likelihood of an attacker capturing valid assertions in transit.

bash

# Restrict phpMyFAQ admin interface to internal network (nginx example)
location /admin/ {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://phpmyfaq_backend;
}