The vulnerability in phpMyFAQ allows an attacker who knows a user’s password to bypass the two‑factor authentication limit by resetting the failure counter whenever a new session cookie is established. Because the counter is scoped to the session and reset after a successful password re‑authentication, an adversary can repeatedly authenticate with the password, obtain a fresh session, and then try unlimited TOTP codes. If successful, the attacker gains full access to the protected system, compromising all user data.

phpMyFAQ versions earlier than 4.1.7 are affected. The CVE applies to the phpMyFAQ web application supplied by the software’s open‑source vendor. Any deployments of phpMyFAQ 4.0 through 4.1.6 without the patch are vulnerable.

The CVSS score of 9.1 classifies this flaw as critical, indicating a high likelihood of successful exploitation if not mitigated. The EPSS score is not available, but the lack of an official KEV listing suggests no widespread active attacks yet, though the high severity warrants immediate attention. The attack can be carried out over the network by sending a valid password and then repeatedly using new session cookies to reset the counter, allowing an attacker to brute‑force the TOTP code and gain full control of the account.