This vulnerability allows an attacker to attach a WebAuthn credential to any user account without possessing valid authentication or completing the normal challenge flow. By submitting a forged credential with a special format, an adversary can create a passkey for a chosen username and then log in as that user without providing a password or two‑factor token. The weakness is a classic authentication bypass, represented by CWE‑287, which permits unauthorized access to user accounts and potential account takeover.

phpMyFAQ versions 4.0.0 through 4.1.8 are affected. Users running any earlier or later releases are not impacted.

The CVSS score of 9.3 classifies this flaw as Critical, and its remote web‑based attack vector means an attacker can exploit it over the network without user interaction. EPSS data is unavailable, so the likelihood of exploitation is unknown, but the flaw is publicly disclosed and KEV is not listed yet. The vulnerability can be triggered by any web‑connected client capable of submitting a forged WebAuthn registration request, making it highly actionable for attackers targeting exposed phpMyFAQ installations.