CVE-2026-76213: Improper Restriction of Excessive Authentication Attempts in thorsten phpMyFAQ
phpMyFAQ before 4.1.7 contains a brute-force vulnerability in the two-factor authentication step where the failure counter is session-scoped and reset on each successful password re-authentication. Attackers with a valid password can bypass the five-attempt limit by obtaining a fresh session cookie and repeatedly re-authenticating to reset the counter, enabling unbounded TOTP code guessing.
AI Analysis
Technical Summary
CVE-2026-76213 describes a vulnerability in phpMyFAQ prior to version 4.1.7 where the two-factor authentication failure counter is scoped to the session and resets after each successful password re-authentication. Attackers who have valid passwords can exploit this by acquiring fresh session cookies and repeatedly re-authenticating, effectively bypassing the five-attempt limit on TOTP code entry. This flaw enables unbounded brute-force attempts against the TOTP verification step, undermining the security of two-factor authentication.
Potential Impact
An attacker with a valid password can bypass the intended limit on TOTP code entry attempts, allowing unlimited guesses of the two-factor authentication code. This significantly increases the risk of unauthorized account access despite two-factor authentication being enabled.
Mitigation Recommendations
No official patch or remediation level has been confirmed yet. Users should monitor the vendor advisory for updates and apply any official fixes once available. Until then, consider additional protective measures such as monitoring authentication attempts or temporarily disabling two-factor authentication if feasible and safe.
CVE-2026-76213: Improper Restriction of Excessive Authentication Attempts in thorsten phpMyFAQ
Description
phpMyFAQ before 4.1.7 contains a brute-force vulnerability in the two-factor authentication step where the failure counter is session-scoped and reset on each successful password re-authentication. Attackers with a valid password can bypass the five-attempt limit by obtaining a fresh session cookie and repeatedly re-authenticating to reset the counter, enabling unbounded TOTP code guessing.
CVSS v4.0
Score 9.1critical
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-76213 describes a vulnerability in phpMyFAQ prior to version 4.1.7 where the two-factor authentication failure counter is scoped to the session and resets after each successful password re-authentication. Attackers who have valid passwords can exploit this by acquiring fresh session cookies and repeatedly re-authenticating, effectively bypassing the five-attempt limit on TOTP code entry. This flaw enables unbounded brute-force attempts against the TOTP verification step, undermining the security of two-factor authentication.
Potential Impact
An attacker with a valid password can bypass the intended limit on TOTP code entry attempts, allowing unlimited guesses of the two-factor authentication code. This significantly increases the risk of unauthorized account access despite two-factor authentication being enabled.
Mitigation Recommendations
No official patch or remediation level has been confirmed yet. Users should monitor the vendor advisory for updates and apply any official fixes once available. Until then, consider additional protective measures such as monitoring authentication attempts or temporarily disabling two-factor authentication if feasible and safe.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-08-19T11:34:28.577Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a85bc76acd9273b492f498a
Added to database: 08/19/2026, 14:23:50 UTC
Last enriched: 08/19/2026, 14:55:09 UTC
Last updated: 08/19/2026, 17:55:41 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.