CVE-2026-111886: phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta 2FA Brute-Force via remove-twofactor Endpoint
phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta lacks brute-force lockout in the removeTwofactorConfig() 2FA removal endpoint, allowing authenticated attackers to guess TOTP codes without limit. Attackers holding a hijacked session and CSRF token can repeatedly POST guesses to /api/user/remove-twofactor to permanently disable the victim's 2FA.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
phpMyFAQto a version that resolves this vulnerability.Fixed in 4.2.0-beta
Event History
Frequently Asked Questions
What must an attacker have before they can exploit this issue?
The attacker needs an authenticated victim session that has been hijacked and a valid CSRF token. They can then repeatedly submit TOTP guesses to the 2FA-removal API endpoint.
Are unauthenticated internet attackers able to disable 2FA directly?
No. The described attack requires an authenticated session and CSRF token, so it depends on prior access to or compromise of a victim's session.
Which deployments are affected?
The affected range is phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta. The issue is in the removeTwofactorConfig() endpoint at /api/user/remove-twofactor.
What is the impact if exploitation succeeds?
Successful TOTP guessing permanently disables 2FA for the victim account. This removes the account's second-factor protection for subsequent authentication attempts.