Based on the description, it is inferred that the WebAuthn login challenge generated by prepareForLogin is not stored, so the subsequent verification step does not detect a null challenge. This flaw allows an attacker who captures a successful WebAuthn assertion to replay it indefinitely, thereby authenticating as the user without any interaction or hardware key. The vulnerability effectively bypasses two‑factor authentication, resulting in unauthorized credential use.

As stated, the affected product is phpMyFAQ, versions up to and including 4.1.5. Any instance running these releases is at risk, regardless of hosting environment.

Based on the description, it is inferred that the likely attack vector involves intercepting a successful WebAuthn assertion, which can be captured over an insecure connection or through session hijacking. The CVSS base score of 9.1 indicates a critical vulnerability with a high impact. The EPSS score is not available, so no current exploitation probability estimate has been published. Because the flaw permits a replay of a WebAuthn assertion, an attacker only needs to intercept the traffic or gain a session, which is feasible over an insecure connection. The vulnerability is not listed in CISA’s KEV catalog, but the absence does not mitigate the inherent risk. Attackers who intercept a successful authentication can replay the assertion indefinitely to gain access.