CVE-2026-76213

phpMyFAQ before 4.1.7 contains a brute-force vulnerability in its two-factor authentication step. The root cause is that the TOTP failure counter is session-scoped and resets on each successful password re-authentication. An attacker who already possesses a valid password can bypass the five-atte...

CVE-2026-76213 phpMyFAQ before 4.1.7 2FA Brute-Force via Session-Scoped Throttle

phpMyFAQ before 4.1.7 contains a brute-force vulnerability in the two-factor authentication step where the failure counter is session-scoped and reset on each successful password re-authentication. Attackers with a valid password can bypass the five-attempt limit by obtaining a fresh session cook...