The vulnerability is present in phpMyFAQ versions prior to 4.2.0‑beta. The removeTwofactorConfig() endpoint has no brute‑force lockout, allowing an attacker with a hijacked session and CSRF token to send repeated TOTP guesses to /api/user/remove‑twofactor. Each successful guess permanently disables the victim’s two‑factor authentication, effectively bypassing the second factor and granting continued access. This insecurity is characterized as an authentication bypass, CWE‑307.

The affected product is phpMyFAQ from vendor thorsten, specifically versions 4.2.0‑alpha 2 through 4.2.0‑beta. The vulnerability is triggered via the /api/user/remove‑twofactor endpoint and only applies to installations that expose this API to authenticated users.

The CVSS score of 7.1 indicates a high severity client‑side flaw. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, implying limited widespread exploitation. Nevertheless, an attacker must first acquire a hijacked session and a valid CSRF token; once those prerequisites are met, the attacker can iterate through TOTP codes without restriction, disabling the victim’s 2FA and enabling further unauthorized activity. The absence of a lockout or rate limiting makes exploitation trivial in a compromised session.