phpMyFAQ weak password recovery in UnauthorizedUserController

Executive brief

phpMyFAQ is an open-source FAQ software. A vulnerability in its password reset system allows an attacker to force a password change for any user if they know the user's username and email address. This can lead to immediate account lockout for legitimate users, disrupting operations and requiring manual recovery.

Technical details

A weak password recovery mechanism exists in the `UnauthorizedUserController.php` component of phpMyFAQ. The `user/password/update` API endpoint processes PUT requests and immediately updates a user's password in the database if the provided username and email match, without requiring a reset token or out-of-band confirmation. An attacker can exploit this to perform account enumeration based on different HTTP response codes (200 OK vs 409 Conflict) and cause a denial-of-service by invalidating the victim's current credentials. The issue is fixed in version 4.1.3 by implementing a token-based reset flow.

Affected products

• thorsten phpMyFAQ < 4.1.3

Timeline

• 2026-05-14: disclosed: Initial disclosure on GitHub
• 2026-05-20: advisory: GitHub Advisory published
• 2026-05-20: patched: Fix released in version 4.1.3

References

• https://api.github.com/users/kitu232
• https://github.com/kitu232
• https://api.github.com/users/kitu232/gists%7B/gist_id%7D
• https://api.github.com/users/kitu232/repos
• https://avatars.githubusercontent.com/u/90661022?v=4
• https://api.github.com/users/kitu232/events%7B/privacy%7D