Description
phpMyFAQ is an open source FAQ web application. Versions 3.2.0 through 4.1.5 contain an authentication bypass in its public two-factor authentication verification flow: an unauthenticated attacker can submit an account’s numeric user ID and a valid or brute-forced six-digit TOTP code without first authenticating with the account password, allowing takeover of any 2FA-enabled account, including administrator accounts. Version 4.1.6 is patched by binding TOTP verification to a session established after successful password authentication and limiting failed TOTP attempts. No official workaround is documented; affected installations should upgrade to 4.1.6 or later.
Published: 2026-09-24
Score: 8.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Authentication bypass leading to account takeover
Action: Immediate patch
AI Analysis

Impact

The vulnerability allows an attacker to submit a numeric user ID and a valid or brute‑forced six‑digit TOTP code without first authenticating with the account password, thereby bypassing one factor of authentication. This flaw permits takeover of any 2FA‑enabled account, including administrators, and constitutes an authentication bypass (CWE‑287) that endangers confidentiality and integrity of user data.

Affected Systems

The affected product is phpMyFAQ, developed by thorsten. Versions 3.2.0 through 4.1.5 are impacted. Version 4.1.6 adds a patch that binds TOTP verification to a session established after successful password authentication and limits failed TOTP attempts, thereby fixing the flaw.

Risk and Exploitability

The CVSS score of 8.1 indicates high severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, but the potential for complete account takeover makes the risk significant. Exploitation likely proceeds by accessing the public two‑factor verification endpoint, supplying a known user ID and a valid or brute‑forced TOTP, with no prior authentication required.

Generated by OpenCVE AI on September 25, 2026 at 11:24 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade phpMyFAQ to version 4.1.6 or later, where the two‑factor verification is bound to a session initiated after password authentication and failed attempts are limited.
  • If an immediate upgrade is not feasible, temporarily block or disable the public TOTP verification endpoint and enforce password authentication before any TOTP check to restore the intended two‑factor flow.
  • After applying a fix or temporary mitigation, review application logs for anomalous TOTP requests, lock out accounts with repeated failures, and ensure all user accounts have strong passwords and two‑factor enabled.

Generated by OpenCVE AI on September 25, 2026 at 11:24 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-8gpw-xvpf-hvx5 phpMyFAQ's two-factor authentication login bypasses the password factor
History

Tue, 29 Sep 2026 03:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 25 Sep 2026 02:30:00 +0000

Type Values Removed Values Added
First Time appeared Thorsten
Thorsten phpmyfaq
Vendors & Products Thorsten
Thorsten phpmyfaq

Thu, 24 Sep 2026 15:30:00 +0000

Type Values Removed Values Added
Description phpMyFAQ is an open source FAQ web application. Versions 3.2.0 through 4.1.5 contain an authentication bypass in its public two-factor authentication verification flow: an unauthenticated attacker can submit an account’s numeric user ID and a valid or brute-forced six-digit TOTP code without first authenticating with the account password, allowing takeover of any 2FA-enabled account, including administrator accounts. Version 4.1.6 is patched by binding TOTP verification to a session established after successful password authentication and limiting failed TOTP attempts. No official workaround is documented; affected installations should upgrade to 4.1.6 or later.
Title phpMyFAQ's two-factor authentication login bypasses the password factor
Weaknesses CWE-287
References
Metrics cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Thorsten Phpmyfaq
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-09-29T02:47:34.341Z

Reserved: 2026-06-22T19:17:28.959Z

Link: CVE-2026-56737

cve-icon Vulnrichment

Updated: 2026-09-29T02:47:30.311Z

cve-icon NVD

Status : Deferred

Published: 2026-09-24T16:17:07.637

Modified: 2026-09-29T03:17:16.310

Link: CVE-2026-56737

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-25T11:30:16Z

Weaknesses