Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.3

phpMyFAQ: Unauthenticated Access to Admin Panel

CVE-2026-45010 · published 5 months ago
Summary

An attacker can try many different passwords for a user's two-factor authentication code, eventually guessing it correctly and gaining full access to the admin panel. This is a serious issue because an attacker could make changes to the site that affect everyone who uses it. To fix this, update to phpMyFAQ version 4.1.2 or later.

Original advisory text
phpMyFAQ before 4.1.2 contains an improper restriction of excessive authentication attempts vulnerability in the /admin/check endpoint, which accepts arbitrary user-id parameters without session bi...
phpMyFAQ before 4.1.2 contains an improper restriction of excessive authentication attempts vulnerability in the /admin/check endpoint, which accepts arbitrary user-id parameters without session binding or rate limiting. Unauthenticated attackers can brute-force any user's six-digit TOTP code by submitting POST requests with sequential token values, bypassing two-factor authentication to gain full administrative access.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.3 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-307Improper Restriction of Excessive Authentication Attempts
Timeline
Published15 May 2026
Updated4 Nov 2026
First seen15 May 2026
Sources
CVE-2026-45010 · NVD
Track software like this
Free during beta