Executive Summary
CVE-2026-124432 is an account enumeration flaw in phpMyFAQ, rated CVSS 7.3 (High). The unauthenticated POST /api/webauthn/prepare-login endpoint responds differently depending on whether an account has a registered passkey.
Vulnerability Details
| Field | Value |
|---|---|
| CVE | CVE-2026-124432 |
| CVSS | 7.3 |
| Endpoint | POST /api/webauthn/prepare-login |
| Authentication | None |
| Fixed in | 4.1.11, 4.2.0-beta.3 |
For accounts with a registered passkey, the endpoint returns the stable stored credential IDs. For accounts without one, it returns a fallback ID derived from md5(time()). An attacker can submit candidate usernames and tell the two cases apart: stable IDs repeat across requests, while the fallback values change.
That lets an attacker confirm which accounts exist and which have passkeys, which is useful for targeted phishing and credential-stuffing.
Remediation
- Upgrade to phpMyFAQ 4.1.11 or later, or 4.2.0-beta.3 or later on the 4.2 line.
- Rate-limit requests to
/api/webauthn/prepare-login. - Watch for bursts of unauthenticated requests to that endpoint from a single source.