# phpMyFAQ 2FA bypass via unauthenticated brute-force in admin check endpoint

Source: https://junglewise.ai/threats/phpmyfaq-2fa-bypass-via-unauthenticated-brute-force-in-admin-check-7a3aa01c  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-15. Updated: 2026-06-09  
License: CC BY 4.0 with a link back

Severity: critical · CVSS 9.1 · Published 2026-05-15

phpMyFAQ, an open-source FAQ software, contains a security flaw in its administrative login process. An attacker can bypass two-factor authentication (2FA) by repeatedly guessing the six-digit security code without needing the user's password. If successful, the attacker gains full administrative control over the system, allowing them to modify content, manage users, and access sensitive backups.

Technologies: [phpmyfaq/phpmyfaq (Packagist)](https://junglewise.ai/threats/technologies/phpmyfaq-phpmyfaq), [thorsten/phpmyfaq (Packagist)](https://junglewise.ai/threats/technologies/thorsten-phpmyfaq), [Thorsten phpMyFAQ](https://junglewise.ai/threats/technologies/phpmyfaq). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist), [Thorsten](https://junglewise.ai/threats/vendors/thorsten).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** Critical severity, with a CVSS score of 9.1, published 15 May 2026.

**Which products and versions are affected?** phpmyfaq/phpmyfaq (Packagist) < 4.1.2; thorsten/phpmyfaq (Packagist) < 4.1.2; Thorsten phpMyFAQ < 4.1.2.

**Is there a fix for This vulnerability?** A patch was published on 2026-06-09: Duplicate advisory withdrawn and consolidated into original report Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is This vulnerability attacked?** It is attacked over the network, in a network appliance.

**Am I affected?** Check whether you run phpmyfaq/phpmyfaq (Packagist), thorsten/phpmyfaq (Packagist) or Thorsten phpMyFAQ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The /admin/check endpoint in phpMyFAQ's AuthenticationController implements the SkipsAuthenticationCheck interface, making it accessible without a prior session or password verification. The endpoint accepts arbitrary user-id and token parameters from a POST request without verifying if the user has already passed the first stage of authentication. Because there is no rate limiting or session binding for these requests, an attacker can brute-force the 1,000,000 possible six-digit TOTP combinations within a single 30-second window or across multiple windows. A successful guess grants the attacker a fully authenticated administrative session. This issue is resolved in version 4.1.2.

## Affected products

- thorsten phpMyFAQ < 4.1.2

## Timeline

- 2026-04-28: advisory: Original vendor advisory published
- 2026-05-15: disclosed: CVE-2026-45010 published to NVD
- 2026-06-09: patched: Duplicate advisory withdrawn and consolidated into original report

## References

- [https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-9pq7-mfwh-xx2j](https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-9pq7-mfwh-xx2j)
- [https://www.vulncheck.com/advisories/phpmyfaq-unauthenticated-two-factor-authentication-brute-force-via-admin-check-endpoint](https://www.vulncheck.com/advisories/phpmyfaq-unauthenticated-two-factor-authentication-brute-force-via-admin-check-endpoint)

## Related threats

- [phpMyFAQ insufficient authorization in group deletion](https://junglewise.ai/threats/cve-2026-124433-phpmyfaq-before-4-1-11-contains-an-insufficient-authorization)
- [phpMyFAQ WebAuthn account enumeration in prepare-login](https://junglewise.ai/threats/cve-2026-124432-phpmyfaq-4-1-9-before-4-1-11-and-4-2-0-pre-releases-before-4-2-0)
- [phpMyFAQ authorization bypass in attachment downloads](https://junglewise.ai/threats/cve-2026-111910-phpmyfaq-before-4-1-9-and-4-2-0-alpha-before-4-2-0-beta-contains)
- [phpMyFAQ missing authorization in deleteUser API](https://junglewise.ai/threats/cve-2026-111909-phpmyfaq-before-4-1-9-contains-a-missing-authorization)
- [phpMyFAQ broken object-level authorization in FAQ update API](https://junglewise.ai/threats/cve-2026-111908-phpmyfaq-4-0-0-before-4-1-9-and-4-2-0-alpha-before-4-2-0-beta)