Is CVE-2026-56737 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-56737 being exploited in the wild.

How severe is CVE-2026-56737?

High severity, with a CVSS score of 8.1, published 24 September 2026.

Which products and versions are affected?

phpmyfaq/phpmyfaq (Packagist) >= 3.2.0, = 3.2.0, < 4.1.6, ECOSYSTEM:introduced=3.2.0,fixed=4.1.6.

Is there a fix for CVE-2026-56737?

Yes. phpmyfaq/phpmyfaq (Packagist): upgrade to 4.1.6 or later; thorsten/phpmyfaq (Packagist): upgrade to 4.1.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-56737 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-56737?

Check whether you run phpmyfaq/phpmyfaq (Packagist) or thorsten/phpmyfaq (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-56737: phpMyFAQ two-factor authentication password bypass

Q: Is there a fix for CVE-2026-56737?

Yes. phpmyfaq/phpmyfaq (Packagist): upgrade to 4.1.6 or later; thorsten/phpmyfaq (Packagist): upgrade to 4.1.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-56737 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-56737?

Check whether you run phpmyfaq/phpmyfaq (Packagist) or thorsten/phpmyfaq (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-56737 · Severity: high · CVSS 8.1 · Published 2026-09-24

phpMyFAQ is a popular FAQ management system. Its two-factor authentication feature allows accounts to authenticate using only a 6-digit code without verifying the account password, completely bypassing the password requirement. Combined with the lack of brute-force protections, attackers can gain full administrative access to accounts protected by 2FA by guessing the code.

Technologies: phpmyfaq/phpmyfaq (Packagist), thorsten/phpmyfaq (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2026-56737 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-56737 being exploited in the wild.
How severe is CVE-2026-56737?: High severity, with a CVSS score of 8.1, published 24 September 2026.
Which products and versions are affected?: phpmyfaq/phpmyfaq (Packagist) >= 3.2.0, < 4.1.6, ECOSYSTEM:introduced=3.2.0,fixed=4.1.6; thorsten/phpmyfaq (Packagist) >= 3.2.0, < 4.1.6, ECOSYSTEM:introduced=3.2.0,fixed=4.1.6.
Is there a fix for CVE-2026-56737?: Yes. phpmyfaq/phpmyfaq (Packagist): upgrade to 4.1.6 or later; thorsten/phpmyfaq (Packagist): upgrade to 4.1.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-56737 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-56737?: Check whether you run phpmyfaq/phpmyfaq (Packagist) or thorsten/phpmyfaq (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

phpmyfaq/phpmyfaq (Packagist): upgrade to 4.1.6 or later
```
composer require phpmyfaq/phpmyfaq:^4.1.6
```
thorsten/phpmyfaq (Packagist): upgrade to 4.1.6 or later
```
composer require thorsten/phpmyfaq:^4.1.6
```

Technical details

The vulnerability is an authentication bypass (CWE-287/CWE-306) in the frontend `/check` endpoint. The endpoint accepts a user-id and TOTP token, then calls `twoFactorSuccess()` to establish a full authenticated session without ever validating the user's password. There is no server-side state (e.g., a flag) confirming that password authentication completed before the 2FA step. The admin authentication flow correctly implements this check via a `2fa_pending_user_id` session variable, demonstrating the frontend omission is a regression. The vulnerability affects any account with 2FA enabled. The `/check` endpoint has no lockout or rate-limiting, allowing attackers to brute-force the 6-digit TOTP space across time windows and gain full account takeover with no password knowledge.

Affected products

phpMyFAQ phpMyFAQ

Identifiers

CVE-2026-56737
GHSA-8gpw-xvpf-hvx5

Timeline

2026-09-24: disclosed
2026-09-24: advisory: GHSA-8gpw-xvpf-hvx5

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.