CVE-2026-111886 Details
Description
phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta lacks brute-force lockout in the removeTwofactorConfig() 2FA removal endpoint, allowing authenticated attackers to guess TOTP codes without limit. Attackers holding a hijacked session and CSRF token can repeatedly POST guesses to /api/user/remove-twofactor to permanently disable the victim's 2FA.
A vulnerability exists in phpMyFAQ versions 4.2.0-alpha.2 prior to 4.2.0-beta, where the removeTwofactorConfig() endpoint for two-factor authentication (2FA) removal lacks a brute-force lockout mechanism. This flaw allows authenticated attackers to repeatedly guess Time-Based One-Time Password (TOTP) codes without any limitations. Attackers with a hijacked session and a valid CSRF token can exploit this by sending multiple POST requests to the /api/user/remove-twofactor endpoint, effectively disabling the victim's 2FA permanently.
Users can update to phpMyFAQ version 4.1.9 or later, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 17, 2026CISA-ADP
Assessed Oct 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-7pjw-6v4g-f837 | CISA-ADP | AdvisoryTechnical AnalysisVendor |
| https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-7pjw-6v4g-f837 | [email protected] | AdvisoryTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/phpmyfaq-4.2.0-alpha.2-before-4.2.0-beta-2fa-brute-force-via-remove-twofactor-endpoint | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-307 | Improper Restriction of Excessive Authentication Attempts | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| phpMyFAQ | >= 4.2.0-alpha.2, < 4.2.0-beta (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 18, 2026 | CVE Modified | CISA-ADP |
| Oct 17, 2026 | New CVE Received | [email protected] |