CVE-2026-85590: phpMyFAQ before 4.1.8 Authentication Bypass via Two-Factor Disable
phpMyFAQ before 4.1.8 contains an authentication bypass vulnerability in its two-factor authentication (TOTP) disable functionality. The removeTwofactorConfig() handler (reachable via POST /api/user/remove-twofactor) verifies only that the user is logged in and that a valid CSRF token is supplied, then disables TOTP without requiring password re-entry or a current TOTP code. The same downgrade is also reachable inline via PUT /api/user/data/update, which accepts a plain twofactorenabled form field under the same session+CSRF-only guard. An attacker who has hijacked a user's session can silently strip two-factor protection from any account, including administrator accounts, after which password-only authentication succeeds.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
phpMyFAQto a version that resolves this vulnerability.Fixed in 4.1.8 - Compensating control
Ensure the endpoints that downgrade/disable two-factor authentication are not accessible to an attacker who has only a hijacked user session; add stronger session-bound authorization so that PUT /api/user/data/update (twofactor_enabled form field) and POST /api/user/remove-twofactor cannot disable TOTP based solely on being logged-in plus a valid CSRF token.
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker needs a hijacked authenticated user session and a valid CSRF token. No password re-entry or current TOTP code is required to disable two-factor authentication.
Are administrator accounts affected?
Yes. A hijacked session can be used to disable TOTP for any account, including administrator accounts, allowing subsequent password-only authentication.
Which endpoints should be reviewed for exposure or monitoring evidence?
Review requests to POST /api/user/remove-twofactor and PUT /api/user/data/update. The update endpoint can disable TOTP through a plain twofactor_enabled form field.
What is the immediate mitigation if updating is not possible?
The provided information does not identify a configuration-based workaround. Prioritize protection and invalidation of potentially hijacked sessions, because a valid session and CSRF token are sufficient to perform the downgrade.