phpMyFAQ ships 28 security fixes, then publishes the receipts
A coordinated 28-CVE disclosure in the self-hosted FAQ application phpMyFAQ is dominated by a critical WebAuthn authentication bypass. The patch shipped 14 days before the public advisories landed, which changes how you should read the disclosure.
On 2026-10-17, 28 GitHub Security Advisories and 28 NVD CVE records appeared for phpMyFAQ, the open-source FAQ web application that many people run on their own servers. The batch covers the stable 3.2.x, 4.0.x, and 4.1.x release lines plus the unreleased 4.2.0-alpha/beta line. The headline flaw is CVE-2026-111911 (GHSA-768h-xwv2-fwp3), scored 9.8 CRITICAL.
The WebAuthn registration endpoints in phpMyFAQ 4.0.0 through before 4.1.9 attach credentials to any account without checking authentication or validating the challenge. An attacker stages a victim's username, submits a forged fmt=none attestation to register a passkey, and then logs in, bypassing both the password and TOTP. That is full account takeover.
The fix shipped 14 days before the advisories went public. Release 4.1.9, dated 2026-10-03, lists "fixed security vulnerabilities" in its changelog. The 28 GHSAs and NVD records were published 2026-10-17, two weeks later. The vendor fixed the flaws, shipped the patch, then published the advisory batch. If you self-host phpMyFAQ and you are on 4.1.9 or later, you are already patched. The 2026-10-17 disclosure is the public record of what was fixed, not a new vulnerability that just appeared.
The rest of the batch is a mix of authentication bypasses, authorization gaps, and injection flaws. CVE-2026-111895 covers an authentication bypass in the Microsoft Entra ID login flow, where users are linked by the mutable preferred_username claim and AuthEntraId::create() ignores the duplicate-login exception while continuing with the existing local account. CVE-2026-109573 is a SQL injection in PdoMysql::escape(), which escapes single quotes inconsistently, in versions before 4.1.9. The batch also includes a password-change flow that skips the current-password check (CVE-2026-111884), a missing authorization on the deleteUser() API (CVE-2026-111909), a Keycloak user authentication bypass (CVE-2026-111898), broken object-level authorization (CVE-2026-111908), CSRF on POST /admin/api/update-* endpoints (CVE-2026-111907), account enumeration (CVE-2026-111887), stored XSS in the SvgSanitizer (CVE-2026-111896, CVE-2026-111903), uncontrolled resource consumption on the unauthenticated user/password/update endpoint (CVE-2026-111901), and multiple privilege-escalation flaws in UserController and GroupController (CVE-2026-111890, CVE-2026-111891, CVE-2026-111893).
One entry needs a caveat. CVE-2026-108851, missing authorization in the experimental MCP server faq_search tool, is described in NVD as affecting versions "through 4.1.10." As of 2026-10-18, no 4.1.x release after 4.1.10 (dated 2026-10-09) is visible in the vendor changelog, so its fixed status is unconfirmed. The 4.2.0-beta.2 changelog notes the experimental MCP server was migrated to mcp/sdk, which may resolve it, but that is a beta release, not a stable-line fix.
The 4.2.0-beta.2 line (released 2026-10-09) added hardened multi-tenancy support, an improved audit and activity log with security event tracking, and the MCP server migration. Several GHSAs in the batch target the 4.2.0-alpha/beta line specifically. Those are pre-release hardening items, not stable-line defects.
Most of the 28 GHSAs carry no vendor CVSS score in the GitHub API response. Only the headline 9.8 and a handful of others (8.3, 8.1, 7.5, 7.1) have scores. The NVD records in the batch carry no assigned CVSS metrics yet. There is no KEV entry and no confirmed in-the-wild exploitation for any CVE in this batch as of 2026-10-18.
phpMyFAQ has published a public security advisory for every fixed vulnerability since 2004 and ships a CycloneDX SBOM with releases since 4.1.7. The 4.1.x line has active support through 2027-03-12, and every stable release receives security fixes for at least 12 months.
If you run phpMyFAQ, check your version. If you are on 4.0.0 through 4.1.8, update to 4.1.9 or later. If you are on 3.2.x, the affected boundary starts at 3.2.0, so check the vendor changelog for the corresponding fix release.
Source links (named)
- GHSA-768h-xwv2-fwp3: https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-768h-xwv2-fwp3
- NVD CVE-2026-111911: https://nvd.nist.gov/vuln/detail/CVE-2026-111911
- NVD REST keyword search (phpMyFAQ): https://services.nvd.nist.gov/rest/json/cves/2.0?keywordSearch=phpMyFAQ
- phpMyFAQ vendor changelog: https://www.phpmyfaq.de/changelog/
- phpMyFAQ vendor security page: https://www.phpmyfaq.de/security/
- GitHub Security Advisories API (published 2026-10-17): https://api.github.com/advisories?published=2026-10-17
This article was drafted with AI/LLM assistance and reviewed by a human before publication. All factual claims were checked against the public sources cited above. The feature image was generated with AI. See How we use AI for the full workflow.
