CVE-2026-56737: CWE-287: Improper Authentication in thorsten phpMyFAQ
phpMyFAQ is an open source FAQ web application. Versions 3.2.0 through 4.1.5 contain an authentication bypass in its public two-factor authentication verification flow: an unauthenticated attacker can submit an account’s numeric user ID and a valid or brute-forced six-digit TOTP code without first authenticating with the account password, allowing takeover of any 2FA-enabled account, including administrator accounts. Version 4.1.6 is patched by binding TOTP verification to a session established after successful password authentication and limiting failed TOTP attempts. No official workaround is documented; affected installations should upgrade to 4.1.6 or later.
AI Analysis
Technical Summary
The vulnerability (CVE-2026-56737) in phpMyFAQ affects versions 3.2.0 through 4.1.5 and involves improper authentication (CWE-287) in the public two-factor authentication flow. Specifically, the system allows an unauthenticated attacker to submit an account's numeric user ID along with a valid or brute-forced six-digit TOTP code without first verifying the account password. This flaw enables complete takeover of any 2FA-enabled account, including those with administrative privileges. The issue is resolved in version 4.1.6 by binding TOTP verification to a session established only after successful password authentication and by limiting the number of failed TOTP attempts.
Potential Impact
Successful exploitation allows an unauthenticated attacker to bypass password authentication and take over any account protected by 2FA, including administrator accounts. This leads to full compromise of the affected accounts with high confidentiality, integrity, and availability impact.
Mitigation Recommendations
A fix is available in phpMyFAQ version 4.1.6, which addresses the vulnerability by requiring password authentication before TOTP verification and limiting failed TOTP attempts. Affected installations should upgrade to version 4.1.6 or later. No official workaround is documented.
CVE-2026-56737: CWE-287: Improper Authentication in thorsten phpMyFAQ
Description
phpMyFAQ is an open source FAQ web application. Versions 3.2.0 through 4.1.5 contain an authentication bypass in its public two-factor authentication verification flow: an unauthenticated attacker can submit an account’s numeric user ID and a valid or brute-forced six-digit TOTP code without first authenticating with the account password, allowing takeover of any 2FA-enabled account, including administrator accounts. Version 4.1.6 is patched by binding TOTP verification to a session established after successful password authentication and limiting failed TOTP attempts. No official workaround is documented; affected installations should upgrade to 4.1.6 or later.
CVSS v3.1
Score 8.1high
Affected software
thorsten
phpMyFAQ
pkg:github/thorsten/phpMyFAQRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability (CVE-2026-56737) in phpMyFAQ affects versions 3.2.0 through 4.1.5 and involves improper authentication (CWE-287) in the public two-factor authentication flow. Specifically, the system allows an unauthenticated attacker to submit an account's numeric user ID along with a valid or brute-forced six-digit TOTP code without first verifying the account password. This flaw enables complete takeover of any 2FA-enabled account, including those with administrative privileges. The issue is resolved in version 4.1.6 by binding TOTP verification to a session established only after successful password authentication and by limiting the number of failed TOTP attempts.
Potential Impact
Successful exploitation allows an unauthenticated attacker to bypass password authentication and take over any account protected by 2FA, including administrator accounts. This leads to full compromise of the affected accounts with high confidentiality, integrity, and availability impact.
Mitigation Recommendations
A fix is available in phpMyFAQ version 4.1.6, which addresses the vulnerability by requiring password authentication before TOTP verification and limiting failed TOTP attempts. Affected installations should upgrade to version 4.1.6 or later. No official workaround is documented.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-06-22T19:17:28.959Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ab53f3ff7a7c5410678484d
Added to database: 09/24/2026, 15:18:23 UTC
Last enriched: 09/24/2026, 15:32:44 UTC
Last updated: 09/25/2026, 01:56:00 UTC
Views: 10
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.