CVE-2026-56737 Details
Description
phpMyFAQ is an open source FAQ web application. Versions 3.2.0 through 4.1.5 contain an authentication bypass in its public two-factor authentication verification flow: an unauthenticated attacker can submit an account’s numeric user ID and a valid or brute-forced six-digit TOTP code without first authenticating with the account password, allowing takeover of any 2FA-enabled account, including administrator accounts. Version 4.1.6 is patched by binding TOTP verification to a session established after successful password authentication and limiting failed TOTP attempts. No official workaround is documented; affected installations should upgrade to 4.1.6 or later.
A vulnerability in phpMyFAQ versions 3.2.0 through 4.1.5 allows for authentication bypass in the public two-factor authentication verification process. An unauthenticated attacker can exploit this by sending a valid six-digit TOTP code and a numeric user ID, without needing the account password. This flaw enables the attacker to take over any account with two-factor authentication enabled, including administrator accounts. The issue arises because the TOTP verification is not linked to a prior successful password authentication, leaving a gap that can be exploited. phpMyFAQ version 4.1.6 addresses this vulnerability by requiring password verification before TOTP validation and introducing a limit on failed TOTP attempts.
Users are advised to upgrade to phpMyFAQ version 4.1.6 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/thorsten/phpMyFAQ/commit/410208b90f1d01534812ac5203d3e8d9c7bd591f | [email protected] | Source CodeVendor |
| https://github.com/thorsten/phpMyFAQ/commit/5097dff341fb01e93e8561e7261b3ae657df715a | [email protected] | Source CodeVendor |
| https://github.com/thorsten/phpMyFAQ/commit/6a69f6e2142fde722165c65b7e0a49f3176e87be | [email protected] | Source CodeVendor |
| https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-8gpw-xvpf-hvx5 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| phpMyFAQ | >= 3.2.0, <= 4.1.5 (semver) |
CPE
Remediation
| |
Change History
1 change record found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 24, 2026 | New CVE Received | [email protected] |