phpMyFAQ 4.1.9 before 4.1.11 and 4.2.0 pre-releases before 4.2.0-beta.3 contain an account enumeration vulnerability in the unauthenticated POST /api/webauthn/prepare-login endpoint, which returns stable stored credential IDs for passkey-registered accounts but an md5(time())-derived fallback ID otherwise. Unauthenticated attackers can compare allowCredentials IDs from requests sent more than one second apart, without rate limiting, to identify existing passkey-registered accounts and their credential IDs.
Casky was already ahead
This CVE exploits attack patterns that Casky's 0matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.
CVE-2026-124432 affects phpMyFAQ versions 4.1.9 through 4.1.10 and early 4.2.0 pre-releases, exposing an account enumeration vulnerability in the unauthenticated WebAuthn login preparation endpoint. The flaw stems from inconsistent credential ID generation: passkey-registered accounts return stable stored IDs, while non-registered accounts receive time-derived fallback IDs. Without authentication or rate limiting, attackers can send repeated requests seconds apart to the POST /api/webauthn/prepare-login endpoint and compare the allowCredentials responses to reliably distinguish between existing and non-existing accounts. This impacts any organization deploying phpMyFAQ with WebAuthn/passkey authentication enabled, allowing attackers to build accurate account lists for targeted social engineering, credential stuffing, or further reconnaissance.
While this CVE maps to CWE-204 (Observable Discrepancy) rather than specific MITRE ATT&CK techniques, Casky's Claude-powered analysis would flag the attack pattern as T1589 (Gather Victim Identity Information) combined with T1592 (Gather Victim Host Information) detection logic. Practitioners using Casky would observe findings highlighting: unauthenticated access to authentication endpoints, time-based response variance analysis, absence of rate limiting controls, and information disclosure through differential response analysis. The extended reasoning capability would correlate the stable vs. generated credential ID patterns as a classic information leakage signal, enabling security teams to identify reconnaissance activity targeting WebAuthn implementations and prioritize patching to 4.1.11 or 4.2.0-beta.3 or later.
Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →
Casky has 0 skills that investigate the attack patterns behind CVE-2026-124432. Run one and get CVSS-scored findings in 3 minutes.
Run the skill that detects this →© 2026 Casky.AI, Inc. · AI Security Investigation