CVE-2026-45010 describes an improper restriction of excessive authentication attempts vulnerability in phpMyFAQ prior to version 4.1.2. The affected /admin/check endpoint accepts arbitrary user-id parameters and lacks session binding and rate limiting, allowing unauthenticated attackers to brute-force six-digit TOTP codes by submitting sequential POST requests. This bypasses two-factor authentication and grants full administrative privileges. The vulnerability is rated critical with a CVSS 3.1 score of 9.1 (Network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, high confidentiality and integrity impact, no availability impact). No patch or official remediation level is currently documented.

Successful exploitation allows unauthenticated attackers to bypass two-factor authentication by brute-forcing six-digit TOTP codes, resulting in full administrative access to phpMyFAQ installations prior to version 4.1.2. This compromises confidentiality and integrity of the affected system. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the /admin/check endpoint through network controls or web application firewalls to limit brute-force attempts. Monitor for unusual authentication attempts targeting this endpoint. Avoid relying solely on two-factor authentication without rate limiting or session binding in this context.