Skip to content
Threat Feed

Product

PhpMyFAQ (Prior to 4.1.2)

1 brief RSS
medium advisory

phpMyFAQ Unauthenticated TOTP Bypass via Brute-Force (CVE-2026-45010)

phpMyFAQ before 4.1.2 is vulnerable to improper restriction of excessive authentication attempts in the /admin/check endpoint, allowing unauthenticated attackers to brute-force any user's six-digit TOTP code and bypass two-factor authentication, potentially gaining full administrative access (CVE-2026-45010).

phpMyFAQ cve brute-force totp credential-access authentication-bypass
2r 1t 1c