Executive brief
phpMyFAQ is an open-source FAQ software. A vulnerability in its administration login process allows an attacker to bypass two-factor authentication (2FA) without knowing a user's password. By exploiting this, an attacker can gain full administrative control over the FAQ system, allowing them to modify content, manage users, and access sensitive backups.
Technical details
The `/admin/check` endpoint in `AuthenticationController` implements the `SkipsAuthenticationCheck` interface, making it accessible without any prior authentication. The endpoint accepts a `user-id` and a 6-digit TOTP `token` directly from a POST request without verifying if the user has successfully passed the password authentication phase. Because there is no rate limiting or session binding for this specific check, an attacker can brute-force the 1,000,000 possible TOTP combinations for any user ID. A successful guess grants a fully authenticated administrative session. This issue is patched in version 4.1.2.
Affected products
- thorsten phpmyfaq/phpmyfaq <= 4.1.1
- thorsten thorsten/phpmyfaq <= 4.1.1
Timeline
- 2026-04-28: disclosed: Vulnerability discovered and published to thorsten/phpMyFAQ
- 2026-05-06: advisory: GitHub Advisory published
- 2026-05-06: patched: Fix released in version 4.1.2