External risk intelligence

phpMyFAQ WebAuthn Authentication Bypass via Replay Attack

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-76214

phpMyFAQ is a web-based FAQ application designed to be accessible to users. As a web application, it is commonly deployed in internet-facing configurations to serve documentation and support content to public or external audiences, making its authentication interfaces reachable from the internet.

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical vulnerability in the WebAuthn login process of phpMyFAQ. An attacker could potentially replay a captured successful login assertion to gain persistent access as a user without further interaction or requiring the user's hardware key. The primary concern is to confirm if this technology is in use within our environment.

Stolen logins grant repeated access.
Confirms basic usage and exposure.
Ensure our systems are not affected.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by capturing a valid WebAuthn login assertion after a user successfully authenticates. Since the application fails to properly store and verify the login challenge, the attacker can then replay this captured assertion. This allows them to bypass the usual authentication process and log in as the targeted user without needing the user's interaction or hardware key.

Publicly accessible web application.
Replay captured WebAuthn assertion.
Unauthorized account access.

Live Threat

Current exploitation, exposure, and threat context

When supported by the advisory, an attacker who intercepts a successful WebAuthn assertion could replay it indefinitely to authenticate as a user without any further interaction or hardware key. This vulnerability does not present a risk to Personally Identifiable Information (PII).

User authentication credentials.
Replay of a captured WebAuthn assertion.
Unauthorized user account access.

Operational Fix

Recommended remediation, mitigation, and detection steps

The application owner is primarily responsible for addressing this vulnerability in phpMyFAQ, as it affects a web-based application that handles user authentication. The first practical step is to identify all instances of phpMyFAQ, determine their exposure, and assess business criticality to prioritize remediation efforts. This will involve coordinating with infrastructure or platform teams for deployment details and potentially the network/security teams to confirm reachability and scope.

Application owners must prioritize remediation.
Verify affected instances and their exposure.
Plan for updates during maintenance windows.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is phpMyFAQ?

phpMyFAQ is an open-source, database-driven FAQ application that organizations use to manage and display documentation. It provides a web-based interface where users can search for information, ask questions, and manage support content, typically serving as a self-service knowledge base for customers or employees.

What is the vulnerability in CVE-2026-76214?

This issue is a replay attack, classified as CWE-294 (Authentication Bypass by Capture-replay). In affected versions of phpMyFAQ, the application fails to save the security challenge required for WebAuthn authentication. Because the system does not track these challenges, an attacker can reuse a previously captured, successful login attempt to gain unauthorized access to a user account.

How does an attacker trigger this login bypass?

An attacker must first capture a valid authentication assertion from a legitimate user's successful login. Once obtained, they can replay that specific data packet to the server to authenticate as that user. Notably, this does not happen if the user has not recently completed a login attempt, and it does not allow the attacker to access data if WebAuthn is not currently being used for authentication.

Is my phpMyFAQ instance at risk?

According to Halo Surface Signal, phpMyFAQ is typically deployed as a public-facing web application to serve content to broad audiences. If your instance is reachable from the internet, it is considered externally exposed. You should prioritize verifying if you are using an affected version, as the authentication interface is likely accessible to outside actors.

What should I do to secure my system?

The primary step is to identify all running instances of phpMyFAQ in your environment and confirm their current version. Coordinate with your application and infrastructure teams to plan an update to a secure version that resolves the WebAuthn challenge storage issue. Treat this as a priority, especially for instances that handle sensitive user accounts.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.