Executive brief
phpMyFAQ, an open-source FAQ software, contains a security flaw in its administrative login process. An attacker can bypass two-factor authentication (2FA) by repeatedly guessing the six-digit security code without needing the user's password. If successful, the attacker gains full administrative control over the system, allowing them to modify content, manage users, and access sensitive backups.
Technical details
The /admin/check endpoint in phpMyFAQ's AuthenticationController implements the SkipsAuthenticationCheck interface, making it accessible without a prior session or password verification. The endpoint accepts arbitrary user-id and token parameters from a POST request without verifying if the user has already passed the first stage of authentication. Because there is no rate limiting or session binding for these requests, an attacker can brute-force the 1,000,000 possible six-digit TOTP combinations within a single 30-second window or across multiple windows. A successful guess grants the attacker a fully authenticated administrative session. This issue is resolved in version 4.1.2.
Affected products
- thorsten phpMyFAQ < 4.1.2
Timeline
- 2026-04-28: advisory: Original vendor advisory published
- 2026-05-15: disclosed: CVE-2026-45010 published to NVD
- 2026-06-09: patched: Duplicate advisory withdrawn and consolidated into original report