CVE-2026-111886 phpMyFAQ 4.2.0-alpha.2 before 4.2.0-beta 2FA Brute-Force via remove-twofactor Endpoint
Authenticated attackers can brute-force TOTP codes via the remove-twofactor endpoint to disable 2FA and take over accounts.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2026-111886?
CVE-2026-111886 is a high-severity vulnerability in thorsten phpMyFAQ, published on 17 Oct 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
phpMyFAQ from 4.2.0-alpha.2 before 4.2.0-beta lacks brute-force lockout in the removeTwofactorConfig() 2FA removal endpoint, allowing authenticated attackers to guess TOTP codes without limit. Attackers holding a hijacked session and CSRF token can repeatedly POST guesses to /api/user/remove-twofactor to permanently disable the victim's 2FA.
Weakness: CWE-307
Which versions are affected by CVE-2026-111886?
How do I fix CVE-2026-111886?
No fix has been published for CVE-2026-111886 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-111886 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-111886 exists.
Sources
Also known as GHSA-7pjw-6v4g-f837, GHSA-9p2j-4h8p-3832.