Is CVE-2026-45010 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-45010 being exploited in the wild.

How severe is CVE-2026-45010?

Critical severity, with a CVSS score of 9.1, published 15 May 2026.

Which products and versions are affected?

phpmyfaq/phpmyfaq (Packagist) <= 4.1.1, ECOSYSTEM:introduced=0,fixed=4.1.2; thorsten/phpmyfaq (Packagist) <= 4.1.1, ECOSYSTEM:introduced=0,fixed=4.1.2; Thorsten phpMyFAQ < 4.1.2.

Is there a fix for CVE-2026-45010?

Yes. phpmyfaq/phpmyfaq (Packagist): upgrade to 4.1.2 or later; thorsten/phpmyfaq (Packagist): upgrade to 4.1.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-45010 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-45010?

Check whether you run phpmyfaq/phpmyfaq (Packagist), thorsten/phpmyfaq (Packagist) or Thorsten phpMyFAQ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45010: thorsten phpMyFAQ 2FA bypass via brute-force in /admin/check

Q: Is there a fix for CVE-2026-45010?

Yes. phpmyfaq/phpmyfaq (Packagist): upgrade to 4.1.2 or later; thorsten/phpmyfaq (Packagist): upgrade to 4.1.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-45010 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-45010?

Check whether you run phpmyfaq/phpmyfaq (Packagist), thorsten/phpmyfaq (Packagist) or Thorsten phpMyFAQ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-45010 · Severity: critical · CVSS 9.1 · Published 2026-05-15

phpMyFAQ is an open-source FAQ software. A vulnerability in its administration login process allows an attacker to bypass two-factor authentication (2FA) without knowing a user's password. By exploiting this, an attacker can gain full administrative control over the FAQ system, allowing them to modify content, manage users, and access sensitive backups.

Technologies: phpmyfaq/phpmyfaq (Packagist), thorsten/phpmyfaq (Packagist), Thorsten phpMyFAQ. Vendors: Packagist, Thorsten.

Quick answers

Is CVE-2026-45010 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-45010 being exploited in the wild.
How severe is CVE-2026-45010?: Critical severity, with a CVSS score of 9.1, published 15 May 2026.
Which products and versions are affected?: phpmyfaq/phpmyfaq (Packagist) <= 4.1.1, ECOSYSTEM:introduced=0,fixed=4.1.2; thorsten/phpmyfaq (Packagist) <= 4.1.1, ECOSYSTEM:introduced=0,fixed=4.1.2; Thorsten phpMyFAQ < 4.1.2.
Is there a fix for CVE-2026-45010?: Yes. phpmyfaq/phpmyfaq (Packagist): upgrade to 4.1.2 or later; thorsten/phpmyfaq (Packagist): upgrade to 4.1.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-45010 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-45010?: Check whether you run phpmyfaq/phpmyfaq (Packagist), thorsten/phpmyfaq (Packagist) or Thorsten phpMyFAQ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

phpmyfaq/phpmyfaq (Packagist): upgrade to 4.1.2 or later
```
composer require phpmyfaq/phpmyfaq:^4.1.2
```
thorsten/phpmyfaq (Packagist): upgrade to 4.1.2 or later
```
composer require thorsten/phpmyfaq:^4.1.2
```

Technical details

The `/admin/check` endpoint in `AuthenticationController` implements the `SkipsAuthenticationCheck` interface, making it accessible without any prior authentication. The endpoint accepts a `user-id` and a 6-digit TOTP `token` directly from a POST request without verifying if the user has successfully passed the password authentication phase. Because there is no rate limiting or session binding for this specific check, an attacker can brute-force the 1,000,000 possible TOTP combinations for any user ID. A successful guess grants a fully authenticated administrative session. This issue is patched in version 4.1.2.

Affected products

thorsten phpmyfaq/phpmyfaq <= 4.1.1
thorsten thorsten/phpmyfaq <= 4.1.1

Identifiers

CVE-2026-45010
GHSA-9pq7-mfwh-xx2j

Timeline

2026-04-28: disclosed: Vulnerability discovered and published to thorsten/phpMyFAQ
2026-05-06: advisory: GitHub Advisory published
2026-05-06: patched: Fix released in version 4.1.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.