# CVE-2026-56737: phpMyFAQ two-factor authentication password bypass

Source: https://junglewise.ai/threats/cve-2026-56737-phpmyfaq-two-factor-authentication-password-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-24. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-56737 · Severity: high · CVSS 8.1 · Published 2026-09-24

phpMyFAQ is a popular FAQ management system. Its two-factor authentication feature allows accounts to authenticate using only a 6-digit code without verifying the account password, completely bypassing the password requirement. Combined with the lack of brute-force protections, attackers can gain full administrative access to accounts protected by 2FA by guessing the code.

Technologies: [phpmyfaq/phpmyfaq (Packagist)](https://junglewise.ai/threats/technologies/phpmyfaq-phpmyfaq), [thorsten/phpmyfaq (Packagist)](https://junglewise.ai/threats/technologies/thorsten-phpmyfaq). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-56737 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-56737 being exploited in the wild.

**How severe is CVE-2026-56737?** High severity, with a CVSS score of 8.1, published 24 September 2026.

**Which products and versions are affected?** phpmyfaq/phpmyfaq (Packagist) >= 3.2.0, < 4.1.6, ECOSYSTEM:introduced=3.2.0,fixed=4.1.6; thorsten/phpmyfaq (Packagist) >= 3.2.0, < 4.1.6, ECOSYSTEM:introduced=3.2.0,fixed=4.1.6.

**Is there a fix for CVE-2026-56737?** Yes. phpmyfaq/phpmyfaq (Packagist): upgrade to 4.1.6 or later; thorsten/phpmyfaq (Packagist): upgrade to 4.1.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-56737 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-56737?** Check whether you run phpmyfaq/phpmyfaq (Packagist) or thorsten/phpmyfaq (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- phpmyfaq/phpmyfaq (Packagist): upgrade to 4.1.6 or later

  ```sh
  composer require phpmyfaq/phpmyfaq:^4.1.6
  ```

- thorsten/phpmyfaq (Packagist): upgrade to 4.1.6 or later

  ```sh
  composer require thorsten/phpmyfaq:^4.1.6
  ```


## Technical details

The vulnerability is an authentication bypass (CWE-287/CWE-306) in the frontend `/check` endpoint. The endpoint accepts a user-id and TOTP token, then calls `twoFactorSuccess()` to establish a full authenticated session without ever validating the user's password. There is no server-side state (e.g., a flag) confirming that password authentication completed before the 2FA step. The admin authentication flow correctly implements this check via a `2fa_pending_user_id` session variable, demonstrating the frontend omission is a regression. The vulnerability affects any account with 2FA enabled. The `/check` endpoint has no lockout or rate-limiting, allowing attackers to brute-force the 6-digit TOTP space across time windows and gain full account takeover with no password knowledge.

## Affected products

- phpMyFAQ phpMyFAQ

## Identifiers

- CVE-2026-56737
- GHSA-8gpw-xvpf-hvx5

## Timeline

- 2026-09-24: disclosed
- 2026-09-24: advisory: GHSA-8gpw-xvpf-hvx5

## Related threats

- [phpMyFAQ SQL injection in StopWords::add()](https://junglewise.ai/threats/cve-2026-56738-phpmyfaq-sql-injection-in-stopwords-add)
- [phpMyFAQ SQL LIKE wildcard injection in chat user search](https://junglewise.ai/threats/cve-2026-47132-phpmyfaq-sql-like-wildcard-injection-in-chat-user-search)
- [phpMyFAQ stored XSS in admin FAQ editor via HTML entity bypass](https://junglewise.ai/threats/cve-2026-56736-phpmyfaq-stored-xss-in-admin-faq-editor-via-html-entity-bypass)
- [phpMyFAQ information disclosure of inactive FAQ content in public API](https://junglewise.ai/threats/cve-2026-57994-phpmyfaq-information-disclosure-of-inactive-faq-content-in-public)
- [phpMyFAQ path traversal in PDF export concatenatePaths function](https://junglewise.ai/threats/cve-2026-57961-phpmyfaq-path-traversal-in-pdf-export-concatenatepaths-function)