Description

phpMyFAQ before 4.1.7 contains a brute-force vulnerability in the two-factor authentication step where the failure counter is session-scoped and reset on each successful password re-authentication. Attackers with a valid password can bypass the five-attempt limit by obtaining a fresh session cookie and repeatedly re-authenticating to reset the counter, enabling unbounded TOTP code guessing.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.4",
  "pubDate": "2026-08-19T14:17:47.330Z",
  "pubdate": "2026-08-19T14:17:47.330Z",
  "executiveSummary": "phpMyFAQ before 4.1.7 contains a security vulnerability involving the two-factor authentication (2FA) verification mechanism.\nThe vulnerability is classified as an authentication bypass and brute-force vulnerability affecting phpMyFAQ versions prior to 4.1.7.\nThe primary impact is the circumvention of rate-limiting controls, enabling attackers to perform unbounded brute-force attacks against Time-based One-Time Password (TOTP) codes.\nAttackers require valid account credentials to reach the two-factor authentication verification step.\nThe risk implication is high, as successful exploitation allows unauthorized actors to compromise user accounts protected by multi-factor authentication, potentially leading to unauthorized administrative access or data exposure within the knowledge management system.",
  "technicalDetails": "The root cause of the vulnerability lies in the improper scoping and reset logic of the failure counter within the two-factor authentication step.\nSpecifically, the failure counter is bound to the user session and is inadvertently reset whenever a successful password re-authentication occurs.\nThe vulnerable component is the multi-factor authentication handling module responsible for validating TOTP codes and enforcing attempt limits.\nUnder normal operations, the application restricts authentication attempts to a maximum of five incorrect tries.\nHowever, an attacker possessing valid user credentials can bypass this five-attempt restriction by acquiring a fresh session cookie and repeatedly executing the password re-authentication phase.\nEach successful password re-authentication resets the underlying session-scoped failure counter back to zero, effectively neutralizing the brute-force protection mechanism.\nThe attack flow proceeds as follows: first, the attacker authenticates using valid primary credentials to initiate the 2FA challenge. Second, the attacker submits incorrect TOTP guesses up to the threshold limit. Third, when near the limit, the attacker establishes a new session or triggers a password re-authentication event to clear the failure counter. Finally, the attacker resumes guessing TOTP codes in an iterative loop until the correct code is identified, allowing full account access without triggering account lockout or rate-limiting blocks.\nThe vulnerability affects all phpMyFAQ installations prior to version 4.1.7 and requires network exposure to the web application interface along with valid primary authentication credentials."
}