The flaw in phpMyFAQ occurs because the WebAuthn login challenge produced by prepareForLogin is never stored in the database. When a user submits a WebAuthn assertion, the server’s anti‑replay check is bypassed by a null guard; as a result, an attacker who captures a successful assertion can replay it repeatedly and be authenticated without any interaction with the hardware key. This vulnerability is a classic case of improper authentication (CWE‑294) that allows attackers to gain unauthorized access to user accounts.

The affected product is thorsten’s phpMyFAQ, versions up to (and including) 4.1.5. Instances running any version of phpMyFAQ older than 4.1.7, regardless of deployment environment, are vulnerable.

An attacker who intercepts a signed WebAuthn assertion can replay it forever, leveraging the null guard to defeat the replay protection and bypass authentication. The CVSS score of 9.1 indicates a critical severity, while the EPSS score of < 1% suggests that active exploitation of the flaw is currently unlikely. The vulnerability is not listed in the CISA KEV catalog, but the potential for broad impact is high if an attacker can acquire a valid assertion.