CVE-2026-85590
phpMyFAQ before 4.1.8 contains an authentication bypass vulnerability in its two-factor authentication (TOTP) disable functionality. The removeTwofactorConfig() handler (reachable via POST /api/user/remove-twofactor) verifies only that the user is logged in and that a valid CSRF token is supplied, then disables TOTP without requiring password re-entry or a current TOTP code. The same downgrade is also reachable inline via PUT /api/user/data/update, which accepts a plain twofactor_enabled form field under the same session+CSRF-only guard. An attacker who has hijacked a user's session can silently strip two-factor protection from any account, including administrator accounts, after which password-only authentication succeeds.
Scoring
- Severity
- HIGH
- CVSS base score
- 7.1
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
- EPSS probability
- 0.39%
- CWE
- CWE-308
- Published
- 2026-09-04
- Last modified
- 2026-09-04
Affected products
- thorsten phpMyFAQ
- thorsten phpMyFAQ
Weakness type
Related vulnerabilities
- CVE-2026-58240 — Missing Authentication check in SAP NetWeaver (Message Server)
- CVE-2026-67611 — OpenEMR 8.2.0 OAuth2 Password Grant Authentication Bypass via SMART Configuration
- CVE-2026-56022 — Webmin MFA bypass
- CVE-2024-27928 — Vantage6: 2FA can be circumvented with hacked email access
- CVE-2026-45749 — Termix's TOTP two-factor authentication can be disabled or bypassed using only the account password
- CVE-2026-33550 — SOGo before 5.12.5 does not renew the OTP if a user disables/enables it, and has a too short length...
- CVE-2025-64103 — Zitadel Bypass Second Authentication Factor
- CVE-2025-42959 — Missing Authentication check after implementation of SAP Security Note 3007182 and 3537476