Description

phpMyFAQ before 4.1.7 contains a two-factor authentication bypass vulnerability where remember-me tokens are issued before 2FA verification completes. Attackers with valid credentials can obtain a remember-me cookie, skip the 2FA challenge, and replay the cookie to gain full authenticated access without second-factor verification.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.1",
  "pubDate": "2026-08-19T14:17:46.073Z",
  "pubdate": "2026-08-19T14:17:46.073Z",
  "executiveSummary": "phpMyFAQ before 4.1.7 contains a critical authentication flaw involving a two-factor authentication bypass vulnerability. This security defect arises because remember-me tokens are improperly issued prior to the successful completion of the two-factor authentication verification process. Consequently, malicious actors who possess valid primary credentials can intercept or obtain a remember-me cookie during the initial login phase, bypass the subsequent two-factor authentication challenge entirely, and replay the acquired cookie to establish full authenticated access to the target system. The impact of this vulnerability allows unauthorized users to subvert multi-factor security controls, potentially leading to unauthorized data access, administrative compromise, and systemic confidentiality breaches within affected deployments of phpMyFAQ. Exploitation requires valid user credentials and the ability to interact with the authentication workflow to capture and replay session or remember-me tokens. Mitigating this risk requires upgrading the affected software to version 4.1.7 or later where the token issuance sequence is properly enforced after secondary verification.",
  "technicalDetails": "The phpMyFAQ application before version 4.1.7 suffers from a logical flaw within its authentication state machine where session persistence mechanisms are invoked prematurely. Specifically, the generation and issuance of remember-me tokens occur during the initial credential validation phase rather than sequentially following the successful completion of the multi-factor authentication challenge. When a user submits valid primary credentials (username and password), the backend logic initializes the persistent login state and issues a remember-me cookie to the client before verifying the required second factor.\nTo exploit this vulnerability, an attacker must first obtain valid primary credentials for a target account. During the authentication handshake, the attacker initiates a login request with these valid credentials. The server validates the username and password successfully, prematurely generates the cryptographic remember-me token, and sets the corresponding cookie in the HTTP response headers. At this juncture, the application initiates the two-factor authentication challenge to the user interface.\nInstead of completing the second-factor verification step, the attacker intercepts or extracts the newly issued remember-me cookie. The attacker then terminates the current workflow and constructs subsequent HTTP requests incorporating the replayed remember-me cookie. Because the underlying session validation logic fails to verify whether the two-factor authentication state was fully satisfied prior to token creation, the application accepts the replayed cookie as valid proof of authentication.\nThis architectural flaw bypasses the multi-factor security boundary entirely, granting the attacker full authenticated access without completing the second factor. The affected component is the authentication and session management subsystem of phpMyFAQ prior to version 4.1.7. The vulnerability requires network exposure of the application interface, valid primary credentials, and standard cookie manipulation capabilities, resulting in complete authentication bypass and unauthorized privilege escalation."
}