CVE-2026-85590 Details

An authentication bypass vulnerability has been identified in phpMyFAQ versions prior to 4.1.8. This vulnerability allows an attacker to disable two-factor authentication (TOTP) for any user, including administrators, without requiring a password or a current TOTP code. The issue arises in the removeTwofactorConfig() handler, which is accessible via POST /api/user/remove-twofactor. This handler only checks if the user is logged in and if a valid CSRF token is provided, allowing TOTP to be disabled with minimal verification. The same vulnerability can be exploited through PUT /api/user/data/update by sending a plain twofactor_enabled form field under the same session and CSRF token protection. An attacker who has hijacked a user's session can use this flaw to remove two-factor authentication, after which password-only login is sufficient.

Users are advised to update to phpMyFAQ version 4.1.8 or later. Additionally, it is recommended to implement measures that require a current TOTP code or password verification before disabling two-factor authentication. Users should be notified via email when 2FA is disabled, and other active sessions should be invalidated.