Summary
A critical authentication bypass in phpMyFAQ allows WebAuthn registration credentials to be associated with an account without verifying that the requester is authenticated or that the registration challenge is valid. An attacker who can target a victim account may register a passkey and subsequently access the account without its password or TOTP factor.
A critical authentication bypass in phpMyFAQ allows WebAuthn registration credentials to be associated with an account without verifying that the requester is authenticated or that the registration challenge is valid. An attacker who can target a victim account may register a passkey and subsequently access the account without its password or TOTP factor.
Affected context
The issue occurs in phpMyFAQ deployments where WebAuthn registration endpoints accept credential registrations without requiring an authenticated account context and without fully validating the associated registration challenge and attestation. Accounts protected by passwords or TOTP may remain exposed if an attacker can cause a passkey to be attached to the targeted username.
The issue occurs in phpMyFAQ deployments where WebAuthn registration endpoints accept credential registrations without requiring an authenticated account context and without fully validating the associated registration challenge and attestation. Accounts protected by passwords or TOTP may remain exposed if an attacker can cause a passkey to be attached to the targeted username.
Exploit preconditions
- Attack surface: WebAuthn registration and authentication endpoints
- Required access: The ability to submit requests to the registration flow and identify or provide a target username
- Trigger point: Server-side processing of a WebAuthn registration credential
- Why exploitation is possible: The application permits credential attachment without sufficient authentication, challenge binding, or attestation validation
- Attack surface: WebAuthn registration and authentication endpoints
- Required access: The ability to submit requests to the registration flow and identify or provide a target username
- Trigger point: Server-side processing of a WebAuthn registration credential
- Why exploitation is possible: The application permits credential attachment without sufficient authentication, challenge binding, or attestation validation
Why this happens
The underlying flaw is improper authentication enforcement, mapped to CWE-287: Improper Authentication. The registration workflow trusts user-supplied account context and accepts WebAuthn credentials without proving that the requester is authorized to modify that account or that the credential was created in response to a server-issued challenge. This breaks the intended trust relationship between account ownership, registration ceremonies, and subsequent passkey authentication.
The underlying flaw is improper authentication enforcement, mapped to CWE-287: Improper Authentication. The registration workflow trusts user-supplied account context and accepts WebAuthn credentials without proving that the requester is authorized to modify that account or that the credential was created in response to a server-issued challenge. This breaks the intended trust relationship between account ownership, registration ceremonies, and subsequent passkey authentication.
Potential impact
- An attacker may take over targeted user accounts
- Password and TOTP protections could be bypassed for affected accounts
- Unauthorized users may access private FAQs, administrative functions, or stored account data
- Attackers could modify account content, settings, or other resources available to the victim
- Compromised administrative accounts could enable broader application disruption
- An attacker may take over targeted user accounts
- Password and TOTP protections could be bypassed for affected accounts
- Unauthorized users may access private FAQs, administrative functions, or stored account data
- Attackers could modify account content, settings, or other resources available to the victim
- Compromised administrative accounts could enable broader application disruption
General mitigation guidance
Mitigation generally focuses on enforcing account ownership and complete WebAuthn ceremony validation.
Common defensive patterns include:
- Require an already authenticated and authorized session before allowing credential registration
- Bind every registration ceremony to the intended account, server-generated challenge, origin, and relying-party identifier
- Validate attestation and client-data properties using a standards-compliant WebAuthn implementation
- Reject registration attempts when challenge state, user identity, or ceremony state is missing or mismatched
- Apply step-up authentication or existing-factor confirmation before adding a new credential
- Enforce least privilege for administrative and account-management operations
- Provide auditable notifications and credential-management controls for newly registered passkeys
Mitigation generally focuses on enforcing account ownership and complete WebAuthn ceremony validation.
Common defensive patterns include:
- Require an already authenticated and authorized session before allowing credential registration
- Bind every registration ceremony to the intended account, server-generated challenge, origin, and relying-party identifier
- Validate attestation and client-data properties using a standards-compliant WebAuthn implementation
- Reject registration attempts when challenge state, user identity, or ceremony state is missing or mismatched
- Apply step-up authentication or existing-factor confirmation before adding a new credential
- Enforce least privilege for administrative and account-management operations
- Provide auditable notifications and credential-management controls for newly registered passkeys
How teams detect issues like this
Organizations can look for this class of issue through:
- Static analysis and code review of WebAuthn registration handlers for missing authentication or authorization checks
- Review of challenge generation, storage, expiration, and account binding
- Tests that attempt registration without a valid session or with mismatched ceremony state
- Monitoring for passkey registrations that lack a preceding authenticated account-management event
- Policy enforcement requiring server-side verification of origin, relying-party ID, challenge, user handle, and attestation data
- Automated security testing and code-review tools that identify authentication decisions based solely on user-supplied identifiers
Organizations can look for this class of issue through:
- Static analysis and code review of WebAuthn registration handlers for missing authentication or authorization checks
- Review of challenge generation, storage, expiration, and account binding
- Tests that attempt registration without a valid session or with mismatched ceremony state
- Monitoring for passkey registrations that lack a preceding authenticated account-management event
- Policy enforcement requiring server-side verification of origin, relying-party ID, challenge, user handle, and attestation data
- Automated security testing and code-review tools that identify authentication decisions based solely on user-supplied identifiers
