The vulnerability allows an attacker who has hijacked a user session to disable two‑factor authentication by calling the remove-twofactor endpoint or by updating the twofactor_enabled field via the data update API. The request only requires a logged‑in user session and a valid CSRF token, without requiring the current password or a TOTP code. Once two‑factor is disabled, the account—including administrator accounts—can be accessed with only a password, effectively bypassing strong authentication. This flaw is a classic authentication bypass (CWE‑308).

The issue affects the phpMyFAQ application from the vendor thorsten. Versions prior to 4.1.8 are vulnerable; use phpMyFAQ 4.1.8 or later to eliminate the flaw.

The CVSS score of 7.1 indicates moderate to high severity. The EPSS score is unavailable, and the vulnerability is not listed in the CISA KEV catalog. An attacker with a hijacked session token can exploit the flaw via remote web requests, leading to privilege revocation of two‑factor protection. Because the bypass requires only the standard session cookies and a valid CSRF token, there is a practical risk of exploitation when session hijacking or cross‑site request forgery defenses are weak.