GHSA-6626-79jh-5ccr: Duplicate Advisory: phpMyFAQ enables unauthenticated 2FA brute-force attack via /admin/check acceptance of arbitrary user-id
This advisory was withdrawn on Jun 9, 2026. The publisher no longer considers it a valid vulnerability.
Duplicate Advisory This advisory has been withdrawn because it is a duplicate of GHSA-9pq7-mfwh-xx2j. This link is maintained to preserve external references. Original Description phpMyFAQ before 4.1.2 contains an improper restriction of excessive authentication attempts vulnerability in the /admin/check endpoint, which accepts arbitrary user-id parameters without session binding or rate limiting.
Published May 15, 2026 · Updated Jun 9, 2026
Affected packages
thorsten/phpmyfaq
- Ecosystem
- Composer (PHP)
- Affected
- < 4.1.2
- Fixed in
- 4.1.2
- Check
composer show thorsten/phpmyfaq
phpmyfaq/phpmyfaq
- Ecosystem
- Composer (PHP)
- Affected
- < 4.1.2
- Fixed in
- 4.1.2
- Check
composer show phpmyfaq/phpmyfaq
Advisory details
From the GitHub Advisory Database (CC BY 4.0).
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-9pq7-mfwh-xx2j. This link is maintained to preserve external references.
Original Description
phpMyFAQ before 4.1.2 contains an improper restriction of excessive authentication attempts vulnerability in the /admin/check endpoint, which accepts arbitrary user-id parameters without session binding or rate limiting. Unauthenticated attackers can brute-force any user's six-digit TOTP code by submitting POST requests with sequential token values, bypassing two-factor authentication to gain full administrative access.
References
How this page is made: the data panel comes from the GitHub Advisory Database, CISA’s KEV catalog, the NVD and FIRST EPSS, and updates twice a day. No analysis has been written for this entry yet. Methodology