CVE-2026-76213 phpMyFAQ before 4.1.7 2FA Brute-Force via Session-Scoped Throttle
Attackers with valid passwords can bypass two-factor authentication limits by resetting session-scoped failure counters, enabling unbounded TOTP code guessing.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-76213?
CVE-2026-76213 is a critical vulnerability in Phpmyfaq Phpmyfaq, published on 19 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
phpMyFAQ before 4.1.7 contains a brute-force vulnerability in the two-factor authentication step where the failure counter is session-scoped and reset on each successful password re-authentication. Attackers with a valid password can bypass the five-attempt limit by obtaining a fresh session cookie and repeatedly re-authenticating to reset the counter, enabling unbounded TOTP code guessing.
Weakness: CWE-307
Which versions are affected by CVE-2026-76213?
It affects 1 product.
Products include Phpmyfaq Phpmyfaq.
How do I fix CVE-2026-76213?
No fix has been published for CVE-2026-76213 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-76213 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-76213 exists.
Other vulnerabilities in Phpmyfaq Phpmyfaq
- CVE-2023-0310 Cross-site Scripting (XSS) - Stored in thorsten/phpmyfaq
- CVE-2022-4407 Cross-site Scripting (XSS) - Reflected in thorsten/phpmyfaq
- CVE-2017-11187 Security feature bypass in n/a
- CVE-2026-76214 phpMyFAQ before 4.1.7 WebAuthn Replay Attack via Challenge
- CVE-2023-5316 Cross-site Scripting (XSS) - DOM in thorsten/phpmyfaq
Sources
Also known as GHSA-f98m-hcjv-7rp9, GHSA-xgjh-9vcx-v63q.