Live › vulnerability › CVE-2026-111886
Go to dashboardphpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta does not limit failed attempts on its two-factor removal endpoint. An attacker with a hijacked session and CSRF token can guess TOTP codes without limit and permanently disable the victim's 2FA.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Instances of phpMyFAQ in the 4.2.0-alpha.2 to pre-4.2.0-beta range that have two-factor authentication enabled for users are exposed. Instances on earlier or later versions, or installations where no users use 2FA, are not affected by this flaw.
No product ranges from the sources yet.
composer show phpmyfaq/phpmyfaq if installed via Composer.4.2.0-alpha.2 up to but not including 4.2.0-beta.4.2.0-beta or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta lacks brute-force lockout in the removeTwofactorConfig() 2FA removal endpoint, allowing authenticated attackers to guess TOTP codes without limit. Attackers holding a hijacked session and CSRF token can repeatedly POST guesses to /api/user/remove-twofactor to permanently disable the victim's 2FA.
This page as .md · .json · in your agent: get_signal("CVE-2026-111886")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.