CVE-2026-56737 phpMyFAQ's two-factor authentication login bypasses the password factor
Unauthenticated attackers can bypass password authentication by submitting a valid TOTP code, leading to account takeover of any 2FA-enabled user.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-56737?
CVE-2026-56737 is a high-severity authentication bypass vulnerability in thorsten phpMyFAQ, published on 24 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
phpMyFAQ is an open source FAQ web application. Versions 3.2.0 through 4.1.5 contain an authentication bypass in its public two-factor authentication verification flow: an unauthenticated attacker can submit an account’s numeric user ID and a valid or brute-forced six-digit TOTP code without first authenticating with the account password, allowing takeover of any 2FA-enabled account, including administrator accounts. Version 4.1.6 is patched by binding TOTP verification to a session established after successful password authentication and limiting failed TOTP attempts. No official workaround is documented; affected installations should upgrade to 4.1.6 or later.
Weakness: CWE-287
Which versions are affected by CVE-2026-56737?
4 open source packages ship an affected version, including thorsten/phpmyfaq and phpmyfaq/phpmyfaq.
| Package | Affected | Fixed in |
|---|---|---|
thorsten/phpmyfaq Packagist | From 3.2.0 | 4.1.6 |
thorsten/phpmyfaq Packagist | From 3.2.0 | 4.1.6 |
phpmyfaq/phpmyfaq Packagist | From 3.2.0 | 4.1.6 |
phpmyfaq/phpmyfaq Packagist | From 3.2.0 | 4.1.6 |
How do I fix CVE-2026-56737?
Upgrade thorsten/phpmyfaq to 4.1.6 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2026-56737 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-56737 exists.
Sources
Also known as GHSA-8gpw-xvpf-hvx5.