CVE-2026-111886GHSA-7pjw-6v4g-f837
phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta 2FA Brute-Force via remove-twofactor Endpoint
thorsten phpMyFAQ
CVSS
7.1HighExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 18 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.23%Chance of exploitation activity in the next 30 days, higher than 12% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 4.2.0-betaphpMyFAQCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta lacks brute-force lockout in the removeTwofactorConfig() 2FA removal endpoint, allowing authenticated attackers to guess TOTP codes without limit. Attackers holding a hijacked session and CSRF token can repeatedly POST guesses to /api/user/remove-twofactor to permanently disable the victim's 2FA.
Text from CVE List
Affected versions 2
- phpMyFAQaffected: 4.2.0-alpha.2 before 4.2.0-betaCVE List
- phpMyFAQunaffected: 4.2.0-betaCVE List