Executive brief
phpMyFAQ is a popular FAQ management system. Its two-factor authentication feature allows accounts to authenticate using only a 6-digit code without verifying the account password, completely bypassing the password requirement. Combined with the lack of brute-force protections, attackers can gain full administrative access to accounts protected by 2FA by guessing the code.
Technical details
The vulnerability is an authentication bypass (CWE-287/CWE-306) in the frontend `/check` endpoint. The endpoint accepts a user-id and TOTP token, then calls `twoFactorSuccess()` to establish a full authenticated session without ever validating the user's password. There is no server-side state (e.g., a flag) confirming that password authentication completed before the 2FA step. The admin authentication flow correctly implements this check via a `2fa_pending_user_id` session variable, demonstrating the frontend omission is a regression. The vulnerability affects any account with 2FA enabled. The `/check` endpoint has no lockout or rate-limiting, allowing attackers to brute-force the 6-digit TOTP space across time windows and gain full account takeover with no password knowledge.
Affected products
- phpMyFAQ phpMyFAQ
Timeline
- 2026-09-24: disclosed
- 2026-09-24: advisory: GHSA-8gpw-xvpf-hvx5