Brute-force Vulnerability in phpMyFAQ Software by phpMyFAQ Vendor

CVE-2026-111886

What is CVE-2026-111886?

The vulnerability in phpMyFAQ, specifically present in versions prior to 4.2.0-beta, allows authenticated attackers to exploit the removeTwofactorConfig() endpoint. Without a brute-force lockout mechanism, attackers can continually attempt to guess Time-based One-Time Passwords (TOTP) once they have access to a hijacked session and a valid CSRF token. This weakness can lead to the permanent disablement of two-factor authentication for victims, significantly compromising account security.

References