CVE-2026-45010

CRITICAL 9.1

phpMyFAQ - Unauthenticated Two-Factor Authentication Brute-Force via /admin/check Endpoint

CVSS Score

9.1

EPSS Score

0.0%

EPSS Percentile

0th

phpMyFAQ before 4.1.2 contains an improper restriction of excessive authentication attempts vulnerability in the /admin/check endpoint, which accepts arbitrary user-id parameters without session binding or rate limiting. Unauthenticated attackers can brute-force any user's six-digit TOTP code by submitting POST requests with sequential token values, bypassing two-factor authentication to gain full administrative access.

CWE	CWE-307
Vendor	thorsten
Product	phpmyfaq
Published	May 15, 2026

Stay Ahead of the Next One

Get instant alerts for thorsten phpmyfaq

Be the first to know when new critical vulnerabilities affecting thorsten phpmyfaq are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

None

Affected Versions

thorsten / phpmyfaq

0 < 4.1.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-9pq7-mfwh-xx2j vulncheck.com: https://www.vulncheck.com/advisories/phpmyfaq-unauthenticated-two-factor-authentication-brute-force-via-admin-check-endpoint

Credits

🔍 adrgs aisafe-bot