CVE-2026-56737: phpMyFAQ Two-Factor Authentication Bypass Vulnerability
Summary
CVE-2026-56737: phpMyFAQ's two-factor authentication login bypasses the password factor. Affects thorsten/phpmyfaq versions >= 3.2.0, < 4.1.6. Fixed in 4.1.6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
phpMyFAQ is an open-source FAQ management system that allows users to create and manage FAQs easily. It supports features like user management, multilingual support, and a customizable interface. However, a critical vulnerability has been identified in its two-factor authentication (2FA) mechanism, which can lead to unauthorized access to accounts with 2FA enabled.
Vulnerability Detail
The vulnerability arises from the public two-factor verification endpoint 'POST /check', which allows an attacker to log in using only a valid 6-digit TOTP token and a chosen user-id, bypassing the password requirement entirely. This flaw reduces the security of accounts with 2FA enabled to a single factor, making them susceptible to brute-force attacks on the TOTP code. The absence of a lockout mechanism further exacerbates the issue, allowing attackers to attempt multiple guesses without restriction. This vulnerability affects all 2FA-enabled accounts, including those of administrators, leading to potential account takeovers.
How To Fix
Minimum fixed version
4.1.6
This is the first release that contains the fix.
composer require thorsten/phpmyfaq:4.1.6Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, disable two-factor authentication for affected accounts until the package is updated. This can be done by accessing the user settings and turning off the 2FA feature.
Conclusion
The CVE-2026-56737 vulnerability in phpMyFAQ represents a serious security risk for users who have enabled two-factor authentication. By allowing attackers to bypass password requirements, it exposes accounts to potential unauthorized access. Immediate action is recommended to update the software to the latest version to mitigate this risk.
See every vulnerability recorded for thorsten/phpmyfaq →
FAQ
CVE-2026-56737 is a vulnerability in phpMyFAQ that allows attackers to bypass password authentication for accounts with two-factor authentication enabled.
If your installation has 2FA enabled, this vulnerability allows unauthorized users to gain access to accounts without needing the password, posing a significant security risk.
As a temporary workaround, you should disable two-factor authentication for affected accounts until you can apply the update.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 8.1, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for thorsten/phpmyfaq.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
