Authentication Bypass in phpMyFAQ by phpMyFAQ Team

CVE-2026-85590

What is CVE-2026-85590?

An authentication bypass vulnerability exists in phpMyFAQ prior to version 4.1.8 that compromises the two-factor authentication (TOTP) disable feature. The flaw allows an attacker who has hijacked a user's session to disable two-factor authentication without requiring the user to re-enter their password or provide a current TOTP code. This can be exploited through vulnerable API endpoints, enabling unauthorized access to accounts, including those of administrators, and reverting to less secure password-only authentication methods.

References