phpMyFAQ's two-factor authentication login bypasses the password factor

High · CVSS 8.1

### Summary The public two-factor verification endpoint `POST /check` logs a user in based **solely** on a valid 6-digit TOTP token and a chosen `user-id`. It does **not** require — and is not bound to — a prior successful password authentication. For any account that has 2FA enabled, an unauthenticated attacker can authenticate **without knowing the password**, reducing the account to a single factor (a 6-digit code) that is itself brute-forceable because this endpoint has no lockout (see Finding #2).

Remediation

Upgrade thorsten/phpmyfaq to 4.1.6 or later. Upgrade phpmyfaq/phpmyfaq to 4.1.6 or later.

Affected PHP branches

See the source advisory.

Check your site

Source: GitHub Global Security Advisories (Composer ecosystem) · retrieved 2026-10-22T10:19:14-04:00 · https://github.com/advisories/GHSA-8gpw-xvpf-hvx5

← All threats