CVE-2026-76207

phpMyFAQ before 4.1.7 contains a two-factor authentication bypass vulnerability where remember-me tokens are issued before 2FA verification completes. Attackers with valid credentials can obtain a remember-me cookie, skip the 2FA challenge, and replay the cookie to gain full authenticated access...

Timing attack

Affecting versions did not compare tokens in constant time, which could make it possible for an attacker to guess the 2fa token of a user. This has been fixed by using using the crate constanttimeeq for comparison...

Information Disclosure

pimcore/pimcore is vulnerable to information disclosure. The vulnerability exists through brute-force attacks for the 2FA token...

Design/Logic Flaw

Pimcore before 6.2.2 lacks brute force protection for the 2FA token...

CVE-2019-18985

Pimcore before 6.2.2 lacks brute force protection for the 2FA token...