# CVE-2026-85590: phpMyFAQ two-factor authentication bypass via insufficient re-authentication

Source: https://junglewise.ai/threats/cve-2026-85590-phpmyfaq-two-factor-authentication-bypass-via-insufficient-re  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-04. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-85590 · Severity: info · CVSS 7.1 · Published 2026-09-04

phpMyFAQ is a popular open-source FAQ management system used to manage knowledge bases and frequently-asked-question repositories. An attacker who gains access to a user's browser session can permanently disable the account's two-factor authentication without requiring a password or current authentication code, converting any session hijacking into permanent account takeover—including for administrative accounts. After disabling two-factor protection, password-only login succeeds.

Technologies: [Thorsten phpMyFAQ](https://junglewise.ai/threats/technologies/phpmyfaq). Vendors: [Thorsten](https://junglewise.ai/threats/vendors/thorsten).

## Quick answers

**Is CVE-2026-85590 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-85590 being exploited in the wild.

**How severe is CVE-2026-85590?** Informational severity, with a CVSS score of 7.1, published 4 September 2026.

**Which products and versions are affected?** Thorsten phpMyFAQ before 4.1.8.

**Is there a fix for CVE-2026-85590?** A patch was published on 2026-09-04: Patched in version 4.1.8 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-85590 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-85590?** Check whether you run Thorsten phpMyFAQ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an authentication bypass in the two-factor authentication disable functionality, rooted in CWE-308 (Use of Single-factor Authentication). The removeTwofactorConfig() API endpoint (POST /api/user/remove-twofactor) and the inline twofactor_enabled form field in PUT /api/user/data/update both check only for an active session and valid CSRF token—they do not require password re-entry, current TOTP code, or any step-up authentication. An attacker with session hijacking (e.g., via XSS or session theft) can send a single request with a harvested CSRF token to strip 2FA protection from any account. The vulnerability affects phpMyFAQ versions before 4.1.8 and has been patched in version 4.1.8. Attack vector is network-based with low complexity and requires only low privileges (an authenticated session).

## Affected products

- thorsten phpMyFAQ before 4.1.8

## Timeline

- 2026-08-20: disclosed: Vulnerability reported via GitHub Security Advisory
- 2026-09-04: advisory: Public disclosure and CVE publication
- 2026-09-04: patched: Patched in version 4.1.8

## References

- [https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-h96g-59xp-7r5m](https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-h96g-59xp-7r5m)
- [https://www.vulncheck.com/advisories/phpmyfaq-before-4.1.8-authentication-bypass-via-two-factor-disable](https://www.vulncheck.com/advisories/phpmyfaq-before-4.1.8-authentication-bypass-via-two-factor-disable)

## Related threats

- [phpMyFAQ insufficient authorization in group deletion](https://junglewise.ai/threats/cve-2026-124433-phpmyfaq-before-4-1-11-contains-an-insufficient-authorization)
- [phpMyFAQ WebAuthn account enumeration in prepare-login](https://junglewise.ai/threats/cve-2026-124432-phpmyfaq-4-1-9-before-4-1-11-and-4-2-0-pre-releases-before-4-2-0)
- [phpMyFAQ authorization bypass in attachment downloads](https://junglewise.ai/threats/cve-2026-111910-phpmyfaq-before-4-1-9-and-4-2-0-alpha-before-4-2-0-beta-contains)
- [phpMyFAQ missing authorization in deleteUser API](https://junglewise.ai/threats/cve-2026-111909-phpmyfaq-before-4-1-9-contains-a-missing-authorization)
- [phpMyFAQ broken object-level authorization in FAQ update API](https://junglewise.ai/threats/cve-2026-111908-phpmyfaq-4-0-0-before-4-1-9-and-4-2-0-alpha-before-4-2-0-beta)