Description
phpMyFAQ 4.1.9 before 4.1.11 and 4.2.0 pre-releases before 4.2.0-beta.3 contain an account enumeration vulnerability in the unauthenticated POST /api/webauthn/prepare-login endpoint, which returns stable stored credential IDs for passkey-registered accounts but an md5(time())-derived fallback ID otherwise. Unauthenticated attackers can compare allowCredentials IDs from requests sent more than one second apart, without rate limiting, to identify existing passkey-registered accounts and their credential IDs.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| thorsten | phpMyFAQ | — | — |
References
- GitHub Security Advisory (GHSA-2rvx-pqfw-q35r) vendor-advisory
- VulnCheck Advisory: phpMyFAQ before 4.1.11 and 4.2.0-beta.3 Account Enumeration via WebAuthn prepare-login third-party-advisory