CVE-2026-27836: 
PHP vulnerability analysis and mitigation

CVE-2026-27836 is a missing authorization vulnerability in phpMyFAQ, an open-source FAQ web application, that allows unauthenticated attackers to create unlimited active user accounts via the WebAuthn prepare endpoint (/api/webauthn/prepare). All versions prior to 4.0.18 are affected, including up to 4.1.0-RC.6. The vulnerability was disclosed on February 27, 2026, with a patch released in version 4.0.18. It carries a CVSS v3.1 base score of 7.5 (High) (Github Advisory, GitHub Security Advisory).

The root cause is CWE-862 (Missing Authorization) in phpmyfaq/src/phpMyFAQ/Controller/Frontend/Api/WebAuthnController.php (lines 63–79). The vulnerable prepare() method accepts any unauthenticated POST request with a JSON username field and immediately creates a new active user account if the username does not already exist — without checking whether WebAuthn support is enabled (security.enableWebAuthnSupport), whether registration is enabled (security.enableRegistration), verifying a CSRF token, requiring CAPTCHA, or enforcing any rate limiting. The fix (commit f2ab673) adds CSRF token verification, configuration checks for both WebAuthn and registration settings, and changes newly created accounts to blocked status rather than active (GitHub Security Advisory, Patch Commit).

Successful exploitation allows unauthenticated attackers to bypass registration controls entirely, creating unlimited active user accounts even on instances where self-registration is administratively disabled. This enables registration bypass, username squatting (reserving usernames before legitimate users), database exhaustion through mass account creation (potential DoS), and user enumeration via differing responses for existing versus new usernames. While direct confidentiality impact is rated None, the high integrity impact reflects the ability to corrupt the application's user base and undermine access control assumptions (Github Advisory).

A public proof-of-concept (PoC) is included in the official security advisory, demonstrating single and mass account creation using simple curl commands requiring no authentication or special tooling. There is no evidence of active in-the-wild exploitation at this time, and no threat actor attribution has been reported. The EPSS score is approximately 0.062% (19th percentile), indicating a currently low probability of exploitation in the next 30 days. The vulnerability is not listed in the CISA KEV catalog (Github Advisory).

1. Reconnaissance: Identify internet-facing phpMyFAQ instances (versions < 4.0.18) using search engines like Shodan or Censys, or by checking the application's version disclosure on its web interface.
2. Confirm endpoint availability: Send a test POST request to /api/webauthn/prepare on the target to confirm the endpoint is routed and responsive (default configuration).
3. Create a single unauthorized account: Submit a POST request with a JSON body containing a chosen username — no authentication, CSRF token, or captcha required:

curl -X POST https://TARGET/api/webauthn/prepare \
  -H 'Content-Type: application/json' \
  -d '{"username":"attacker_account"}'

4. Mass account creation (optional): Automate bulk account creation to exhaust the database or squatting usernames:

for i in $(seq 1 1000); do
  curl -s -X POST https://TARGET/api/webauthn/prepare \
    -H 'Content-Type: application/json' \
    -d "{\"username\":\"spam_user_$i\"}" &
done

5. User enumeration: Observe differing server responses for existing versus new usernames to enumerate valid accounts on the target instance.
6. Leverage created accounts: Use the newly created active accounts to attempt further access to application features restricted to registered users (Github Advisory, GitHub Security Advisory).

• Network: Repeated POST requests to /api/webauthn/prepare from a single IP or distributed sources, especially in rapid succession; requests lacking a valid CSRF token in the JSON body.
• Logs: Web server access logs showing high-frequency POST requests to /api/webauthn/prepare with Content-Type: application/json; application logs recording mass user creation events in a short time window.
• Database: Sudden spike in user account records in the phpMyFAQ users table, particularly accounts with auth_source set to AUTH_WEB_AUTHN and status active; accounts with email fields set to the username value (a pattern from the vulnerable code path).
• Application: Presence of numerous accounts with sequential or pattern-based usernames (e.g., spam_user_1, spam_user_2, etc.); accounts created outside of normal business hours or registration workflows (Github Advisory).

Upgrade phpMyFAQ to version 4.0.18 or later, which adds CSRF token verification, enforces security.enableWebAuthnSupport and security.enableRegistration configuration checks, and sets newly created accounts to blocked status (Patch Commit). For organizations unable to patch immediately, implement network-level controls (e.g., WAF rules or reverse proxy ACLs) to block or restrict POST requests to /api/webauthn/prepare, and disable WebAuthn functionality if it is not in use. Additionally, audit all existing user accounts — particularly those with auth_source = AUTH_WEB_AUTHN — to identify and remove any unauthorized accounts created during the exposure window (Github Advisory).

The vulnerability was reported by researcher offensiveee and published by the phpMyFAQ maintainer (thorsten) on February 27, 2026. Red Hat acknowledged the CVE in their security tracking. Social media activity was limited, with brief mentions on Bluesky from accounts such as thehackerwire.bsky.social and cyberhub.blog. No significant broader media coverage or notable researcher commentary beyond the original advisory has been identified (Github Advisory).