7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-27836

CVE-2026-27836: phpMyFAQ Allows Unauthenticated Account Creation via WebAuthn Prepare Endpoint

phpMyFAQ is an open source FAQ web application. Prior to version 4.0.18, the WebAuthn prepare endpoint (/api/webauthn/prepare) creates new active user accounts without any authentication, CSRF protection, captcha, or configuration checks. This allows unauthenticated attackers to create unlimited user accounts even when registration is disabled. Version 4.0.18 fixes the issue.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-27836

CVE-2026-27836:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
thorsten/phpmyfaq	composer	< 4.0.18	4.0.18

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The analysis of the provided commit f2ab673f0668753cd0f7c7c8bc7fd2304dcf5cb1 clearly indicates that the vulnerability lies within the prepare method of the WebAuthnController. The patch for this commit adds several crucial security checks that were previously missing. Specifically, it adds checks to ensure that both WebAuthn support and user registration are enabled in the configuration. Furthermore, it introduces a CSRF token verification mechanism to prevent cross-site request forgery attacks. Finally, it changes the default status of a newly created user from 'active' to 'blocked', preventing the immediate use of the created account. The vulnerable function is phpMyFAQ\Controller\Frontend\WebAuthnController::prepare, as it was the entry point for the unauthenticated account creation.

Vulnerable functions

phpMyFAQ\Controller\Frontend\WebAuthnController::prepare

phpmyfaq/src/phpMyFAQ/Controller/Frontend/WebAuthnController.php

The `prepare` function in `WebAuthnController` is an unauthenticated API endpoint. Before the patch, it did not check if user registration or WebAuthn support was enabled. It also lacked CSRF protection. This allowed an unauthenticated attacker to send a POST request with a username, and if the user did not exist, the system would create a new, active user account. The patch mitigates this by adding checks for configuration settings, implementing CSRF validation, and changing the default status of newly created users to 'blocked' instead of 'active'.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.