# CVE-2026-45010: thorsten phpMyFAQ 2FA bypass via brute-force in /admin/check

Source: https://junglewise.ai/threats/cve-2026-45010-thorsten-phpmyfaq-2fa-bypass-via-brute-force-in-admin-check  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-15. Updated: 2026-06-09  
License: CC BY 4.0 with a link back

CVE-2026-45010 · Severity: critical · CVSS 9.1 · Published 2026-05-15

phpMyFAQ is an open-source FAQ software. A vulnerability in its administration login process allows an attacker to bypass two-factor authentication (2FA) without knowing a user's password. By exploiting this, an attacker can gain full administrative control over the FAQ system, allowing them to modify content, manage users, and access sensitive backups.

Technologies: [phpmyfaq/phpmyfaq (Packagist)](https://junglewise.ai/threats/technologies/phpmyfaq-phpmyfaq), [thorsten/phpmyfaq (Packagist)](https://junglewise.ai/threats/technologies/thorsten-phpmyfaq), [Thorsten phpMyFAQ](https://junglewise.ai/threats/technologies/phpmyfaq). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist), [Thorsten](https://junglewise.ai/threats/vendors/thorsten).

## Quick answers

**Is CVE-2026-45010 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-45010 being exploited in the wild.

**How severe is CVE-2026-45010?** Critical severity, with a CVSS score of 9.1, published 15 May 2026.

**Which products and versions are affected?** phpmyfaq/phpmyfaq (Packagist) <= 4.1.1, ECOSYSTEM:introduced=0,fixed=4.1.2; thorsten/phpmyfaq (Packagist) <= 4.1.1, ECOSYSTEM:introduced=0,fixed=4.1.2; Thorsten phpMyFAQ < 4.1.2.

**Is there a fix for CVE-2026-45010?** Yes. phpmyfaq/phpmyfaq (Packagist): upgrade to 4.1.2 or later; thorsten/phpmyfaq (Packagist): upgrade to 4.1.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-45010 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-45010?** Check whether you run phpmyfaq/phpmyfaq (Packagist), thorsten/phpmyfaq (Packagist) or Thorsten phpMyFAQ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- phpmyfaq/phpmyfaq (Packagist): upgrade to 4.1.2 or later

  ```sh
  composer require phpmyfaq/phpmyfaq:^4.1.2
  ```

- thorsten/phpmyfaq (Packagist): upgrade to 4.1.2 or later

  ```sh
  composer require thorsten/phpmyfaq:^4.1.2
  ```


## Technical details

The `/admin/check` endpoint in `AuthenticationController` implements the `SkipsAuthenticationCheck` interface, making it accessible without any prior authentication. The endpoint accepts a `user-id` and a 6-digit TOTP `token` directly from a POST request without verifying if the user has successfully passed the password authentication phase. Because there is no rate limiting or session binding for this specific check, an attacker can brute-force the 1,000,000 possible TOTP combinations for any user ID. A successful guess grants a fully authenticated administrative session. This issue is patched in version 4.1.2.

## Affected products

- thorsten phpmyfaq/phpmyfaq <= 4.1.1
- thorsten thorsten/phpmyfaq <= 4.1.1

## Identifiers

- CVE-2026-45010
- GHSA-9pq7-mfwh-xx2j

## Timeline

- 2026-04-28: disclosed: Vulnerability discovered and published to thorsten/phpMyFAQ
- 2026-05-06: advisory: GitHub Advisory published
- 2026-05-06: patched: Fix released in version 4.1.2

## References

- [https://api.github.com/users/adrgs](https://api.github.com/users/adrgs)
- [https://github.com/adrgs](https://github.com/adrgs)
- [https://api.github.com/users/adrgs/gists%7B/gist_id%7D](https://api.github.com/users/adrgs/gists%7B/gist_id%7D)
- [https://api.github.com/users/adrgs/repos](https://api.github.com/users/adrgs/repos)
- [https://avatars.githubusercontent.com/u/11564377?v=4](https://avatars.githubusercontent.com/u/11564377?v=4)
- [https://api.github.com/users/adrgs/events%7B/privacy%7D](https://api.github.com/users/adrgs/events%7B/privacy%7D)

## Related threats

- [phpMyFAQ insufficient authorization in group deletion](https://junglewise.ai/threats/cve-2026-124433-phpmyfaq-before-4-1-11-contains-an-insufficient-authorization)
- [phpMyFAQ WebAuthn account enumeration in prepare-login](https://junglewise.ai/threats/cve-2026-124432-phpmyfaq-4-1-9-before-4-1-11-and-4-2-0-pre-releases-before-4-2-0)
- [phpMyFAQ authorization bypass in attachment downloads](https://junglewise.ai/threats/cve-2026-111910-phpmyfaq-before-4-1-9-and-4-2-0-alpha-before-4-2-0-beta-contains)
- [phpMyFAQ missing authorization in deleteUser API](https://junglewise.ai/threats/cve-2026-111909-phpmyfaq-before-4-1-9-contains-a-missing-authorization)
- [phpMyFAQ broken object-level authorization in FAQ update API](https://junglewise.ai/threats/cve-2026-111908-phpmyfaq-4-0-0-before-4-1-9-and-4-2-0-alpha-before-4-2-0-beta)