CVE-2026-56737
Deferred Deferred - Pending Action

Authentication Bypass in phpMyFAQ via TOTP Verification

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: GitHub, Inc.

Description
phpMyFAQ is an open source FAQ web application. Versions 3.2.0 through 4.1.5 contain an authentication bypass in its public two-factor authentication verification flow: an unauthenticated attacker can submit an account’s numeric user ID and a valid or brute-forced six-digit TOTP code without first authenticating with the account password, allowing takeover of any 2FA-enabled account, including administrator accounts. Version 4.1.6 is patched by binding TOTP verification to a session established after successful password authentication and limiting failed TOTP attempts. No official workaround is documented; affected installations should upgrade to 4.1.6 or later.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-25
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-56737
EUVD
EUVD-2026-85931

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
thorsten phpmyfaq 3.2.0
thorsten phpmyfaq 4.1.5
thorsten phpmyfaq From 4.1.6 (inc)
phpmyfaq phpmyfaq From 3.2.0 (inc) to 4.1.5 (inc)
phpmyfaq phpmyfaq 4.1.6

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authentication bypass in phpMyFAQ versions 3.2.0 through 4.1.5. An unauthenticated attacker can exploit the public two-factor authentication verification flow by submitting an account's numeric user ID and a valid or brute-forced six-digit TOTP code without providing the account password. This allows takeover of any 2FA-enabled account, including administrator accounts.

Detection Guidance

Check if your phpMyFAQ version is between 3.2.0 and 4.1.5 by running: grep -r '"version"' /path/to/phpmyfaq/config. If vulnerable, look for unauthorized TOTP verification attempts in logs like: grep 'TOTP verification' /var/log/apache2/access.log or similar web server logs.

Impact Analysis

This vulnerability allows attackers to gain unauthorized access to any 2FA-enabled account in phpMyFAQ, including administrator accounts. Attackers can bypass authentication entirely by exploiting the TOTP verification flaw, potentially leading to data theft, unauthorized modifications, or complete system compromise.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements under GDPR (data protection), HIPAA (health information), and other regulations. Failure to protect user data may result in legal penalties, fines, or reputational damage due to non-compliance with security standards.

Mitigation Strategies

Upgrade phpMyFAQ to version 4.1.6 or later immediately. If upgrading is not possible, disable public TOTP verification or restrict access to the verification endpoint until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-56737. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart