CVE-2026-85590
Received Received - Intake

Authentication Bypass in phpMyFAQ via TOTP Disable

Publication date: 2026-09-04

Last updated on: 2026-09-04

Assigner: VulnCheck

Description
phpMyFAQ before 4.1.8 contains an authentication bypass vulnerability in its two-factor authentication (TOTP) disable functionality. The removeTwofactorConfig() handler (reachable via POST /api/user/remove-twofactor) verifies only that the user is logged in and that a valid CSRF token is supplied, then disables TOTP without requiring password re-entry or a current TOTP code. The same downgrade is also reachable inline via PUT /api/user/data/update, which accepts a plain twofactor_enabled form field under the same session+CSRF-only guard. An attacker who has hijacked a user's session can silently strip two-factor protection from any account, including administrator accounts, after which password-only authentication succeeds.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-04
Last Modified
2026-09-04
Generated
2026-09-04
AI Q&A
2026-09-04
EPSS Evaluated
N/A
NVD
CVE-2026-85590
EUVD
EUVD-2026-71013

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
phpmyfaq phpmyfaq to 4.1.8 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-308 The product uses an authentication algorithm that uses a single factor (e.g., a password) in a security context that should require more than one factor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authentication bypass in phpMyFAQ versions before 4.1.8. It allows an attacker with a hijacked user session to disable two-factor authentication (TOTP) for any account, including administrators, by sending a POST request to /api/user/remove-twofactor or manipulating a field in /api/user/data/update. The system only verifies the session and CSRF token, not the user's password or current TOTP code, enabling silent removal of 2FA and leading to full account takeover.

Detection Guidance

To detect this vulnerability, monitor for unauthorized POST requests to /api/user/remove-twofactor or PUT requests to /api/user/data/update that modify the twofactor_enabled field. Check server logs for these endpoints with session and CSRF token activity but no additional authentication steps.

Impact Analysis

If an attacker gains access to your session, they can disable your two-factor authentication and log in using only your password. This could lead to unauthorized access to your account, data theft, or further compromise of the system. Even administrator accounts are vulnerable, which could allow full control over the phpMyFAQ instance.

Compliance Impact

This vulnerability could violate compliance requirements that mandate strong authentication, such as GDPR's security principle (Article 32) or HIPAA's access control safeguards (45 CFR § 164.312(a)(1)). Disabling 2FA weakens authentication, potentially exposing sensitive data to unauthorized access and leading to regulatory penalties for inadequate security controls.

Mitigation Strategies

Upgrade phpMyFAQ to version 4.1.8 or later immediately. Implement additional authentication checks before allowing TOTP disable functionality. Review server logs for suspicious activity targeting these endpoints and invalidate any potentially compromised sessions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-85590. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart