CVE-2026-76213: phpMyFAQ before 4.1.7 2FA Brute-Force via Session-Scoped Throttle
phpMyFAQ before 4.1.7 contains a brute-force vulnerability in the two-factor authentication step where the failure counter is session-scoped and reset on each successful password re-authentication. Attackers with a valid password can bypass the five-attempt limit by obtaining a fresh session cookie and repeatedly re-authenticating to reset the counter, enabling unbounded TOTP code guessing.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
phpMyFAQto a version that resolves this vulnerability.Fixed in 4.1.7
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker needs a valid password for a phpMyFAQ account protected by two-factor authentication. They can then obtain fresh session cookies and re-authenticate after failures to reset the five-attempt TOTP limit.
Is this exploitable without valid account credentials?
No. The described attack requires a valid password, although it does not require the attacker to already possess the victim's TOTP code.
Which versions are affected?
phpMyFAQ versions before 4.1.7 are affected. Upgrading to 4.1.7 or later addresses the reported issue.
How can defenders determine whether attempted exploitation may be occurring?
Review authentication and session activity for repeated successful password re-authentication events followed by failed 2FA attempts, particularly where new session cookies are issued between attempt groups. This pattern may indicate an effort to reset the session-scoped failure counter.