What is GHSA-f46v-r9r2-mgmc?

GHSA-f46v-r9r2-mgmc is a security advisory published by GitHub Security Advisories with Medium severity. phpMyFAQ 4.1.9 before 4.1.11 and 4.2.0 pre-releases before 4.2.0-beta.3 contain an account...

Which CVE IDs does GHSA-f46v-r9r2-mgmc cover?

GHSA-f46v-r9r2-mgmc covers the following CVE IDs: CVE-2026-124432. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-f46v-r9r2-mgmc?

GHSA-f46v-r9r2-mgmc has a CVSS v3 base score of 7.3, published by GitHub Security Advisories.

GHSA-f46v-r9r2-mgmcMediumCVSS 7.3

phpMyFAQ 4.1.9 before 4.1.11 and 4.2.0 pre-releases before 4.2.0-beta.3 contain an account...

Vendor

GitHub Security Advisories

Published

November 8, 2026

Last Modified

November 8, 2026

🔗 CVE IDs covered (1)

CVE-2026-124432 →

📋 Description

phpMyFAQ 4.1.9 before 4.1.11 and 4.2.0 pre-releases before 4.2.0-beta.3 contain an account enumeration vulnerability in the unauthenticated POST /api/webauthn/prepare-login endpoint, which returns stable stored credential IDs for passkey-registered accounts but an md5(time())-derived fallback ID otherwise. Unauthenticated attackers can compare allowCredentials IDs from requests sent more than one second apart, without rate limiting, to identify existing passkey-registered accounts and their credential IDs.

🔗 References (4)

https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-2rvx-pqfw-q35r
https://nvd.nist.gov/vuln/detail/CVE-2026-124432
https://www.vulncheck.com/advisories/phpmyfaq-before-4.1.11-and-4.2.0-beta.3-account-enumeration-via-webauthn-prepare-login
https://github.com/advisories/GHSA-f46v-r9r2-mgmc