# CVE-2026-111886: phpMyFAQ 2FA removal endpoint lacks brute-force lockout

Source: https://junglewise.ai/threats/cve-2026-111886-phpmyfaq-from-4-2-0-alpha-2-before-4-2-0-beta-lacks-brute-force  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-17. Updated: 2026-10-17  
License: CC BY 4.0 with a link back

CVE-2026-111886 · Severity: medium · CVSS 6.5 · Published 2026-10-17

phpMyFAQ is a widely-used knowledge base and FAQ management system. An attacker with access to a victim's user session can make unlimited guesses at the TOTP code needed to disable two-factor authentication, and once successful, permanently remove the victim's 2FA protection. This leaves the compromised account vulnerable to unauthorized access by anyone who learns the password.

Technologies: [Thorsten phpMyFAQ](https://junglewise.ai/threats/technologies/phpmyfaq). Vendors: [Thorsten](https://junglewise.ai/threats/vendors/thorsten).

## Quick answers

**Is CVE-2026-111886 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-111886 being exploited in the wild.

**How severe is CVE-2026-111886?** Medium severity, with a CVSS score of 6.5, published 17 October 2026.

**Which products and versions are affected?** Thorsten phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta; 4.1.x branch suspected but unverified.

**Is there a fix for CVE-2026-111886?** Yes: fixed in phpMyFAQ 4.1.9, 4.2.0-beta. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-111886 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-111886?** Check whether you run Thorsten phpMyFAQ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in phpMyFAQ 4.1.9, 4.2.0-beta

## Technical details

The /api/user/remove-twofactor endpoint in Controller/Frontend/Api/UserController.php calls TwoFactor::validateToken() to verify a TOTP code before disabling 2FA, but lacks the brute-force lockout mechanism (isTwoFactorLockedOut() / twoFactorFailure()) that was added to three other 2FA verification endpoints in an earlier fix. Additionally, the endpoint is structurally exempted from the application's API rate limiter, allowing an authenticated attacker with a CSRF token to submit unlimited wrong-code guesses and eventually succeed.

## Affected products

- thorsten phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta; 4.1.x branch suspected but unverified

## Timeline

- 2026-10-17: disclosed
- 2026-10-03: other: GitHub security advisory published

## References

- [https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-7pjw-6v4g-f837](https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-7pjw-6v4g-f837)
- [https://www.vulncheck.com/advisories/phpmyfaq-4.2.0-alpha.2-before-4.2.0-beta-2fa-brute-force-via-remove-twofactor-endpoint](https://www.vulncheck.com/advisories/phpmyfaq-4.2.0-alpha.2-before-4.2.0-beta-2fa-brute-force-via-remove-twofactor-endpoint)

## Related threats

- [phpMyFAQ insufficient authorization in group deletion](https://junglewise.ai/threats/cve-2026-124433-phpmyfaq-before-4-1-11-contains-an-insufficient-authorization)
- [phpMyFAQ WebAuthn account enumeration in prepare-login](https://junglewise.ai/threats/cve-2026-124432-phpmyfaq-4-1-9-before-4-1-11-and-4-2-0-pre-releases-before-4-2-0)
- [phpMyFAQ authorization bypass in attachment downloads](https://junglewise.ai/threats/cve-2026-111910-phpmyfaq-before-4-1-9-and-4-2-0-alpha-before-4-2-0-beta-contains)
- [phpMyFAQ missing authorization in deleteUser API](https://junglewise.ai/threats/cve-2026-111909-phpmyfaq-before-4-1-9-contains-a-missing-authorization)
- [phpMyFAQ broken object-level authorization in FAQ update API](https://junglewise.ai/threats/cve-2026-111908-phpmyfaq-4-0-0-before-4-1-9-and-4-2-0-alpha-before-4-2-0-beta)