CVE-2026-76214

Katalog CVE

CVSS 7.4 · High EPSS 0,39%

Kerentanan Authentication Bypass by Capture-replay pada phpmyfaq. Skor CVSS 3.1 7.4 (High) menurut vulncheck.com.

Deskripsi (NVD)

phpMyFAQ before 4.1.7 fails to persist the WebAuthn login challenge generated by prepareForLogin, because neither WebAuthn controller saves the mutated key objects back to the database. At login the anti-replay comparison is skipped by its own null guard, allowing an attacker who captures a successful WebAuthn assertion to replay it indefinitely and authenticate as the user without any interaction or hardware key.

Rincian

Terbit di NVD

19 Agustus 2026

Terakhir diubah

1 September 2026

Status NVD

Analyzed

CVSS 3.1

7.4 (High), sumber vulncheck.com
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-294: Authentication Bypass by Capture-replay

EPSS (30 hari)

0,39% peluang dieksploitasi; lebih tinggi dari 31,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-f534-wv9g-wx2w mitigasi · advisory vendor
• https://www.vulncheck.com/advisories/phpmyfaq-before-webauthn-replay-attack-via-challenge advisory pihak ketiga