CVE-2026-56737
Description
phpMyFAQ is an open source FAQ web application. Versions 3.2.0 through 4.1.5 contain an authentication bypass in its public two-factor authentication verification flow: an unauthenticated attacker can submit an account’s numeric user ID and a valid or brute-forced six-digit TOTP code without first authenticating with the account password, allowing takeover of any 2FA-enabled account, including administrator accounts. Version 4.1.6 is patched by binding TOTP verification to a session established after successful password authentication and limiting failed TOTP attempts. No official workaround is documented; affected installations should upgrade to 4.1.6 or later.
How to fix
- thorsten/phpmyfaq4.1.6 or later
- phpmyfaq/phpmyfaq4.1.6 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| thorsten/phpmyfaqPackagist | 3.2.0 ≤ v < 4.1.6 | 4.1.6 |
| phpmyfaq/phpmyfaqPackagist | 3.2.0 ≤ v < 4.1.6 | 4.1.6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.