CVE-2026-45010: phpMyFAQ TOTP 2FA Brute Force via /admin/check (CWE-307)
phpMyFAQ versions before 4.1.2 contain an improper restriction of excessive authentication attempts (CWE-307) in the /admin/check endpoint, according to the record. The description states that the endpoint lacks session binding and rate limiting, which could allow unauthenticated attackers to bypass two-factor authentication. The record shows a CVSS 3.1 base score of 9.1 and no confirmed active exploitation in the sources consulted.
Overview
The record describes an improper restriction of excessive authentication attempts (CWE-307) in phpMyFAQ before 4.1.2, located in the /admin/check endpoint. According to the description, this endpoint accepts arbitrary user-id parameters without session binding or rate limiting.
Impact
The description states that an unauthenticated attacker could target the six-digit TOTP code of a user and bypass two-factor authentication to gain full administrative access. The record lists a CVSS 3.1 base score of 9.1 with a network attack vector, low complexity and no privileges required, and VulnCheck also records a CVSS 4.0 score of 9.3.
Affected products and versions
- Product: phpMyFAQ, as named in the description.
- Versions described: before 4.1.2.
- The structured affected list in the record is empty, so the exact range should be confirmed against the GitHub advisory and vendor release notes.
Exploitation status
The CISA KEV entry in this record is marked as not listed, and no confirmed active exploitation appears in the sources consulted for this analysis.
Remediation and mitigation
- Upgrade phpMyFAQ to 4.1.2 or later, since the description uses 4.1.2 as the boundary.
- Until the upgrade is applied, restrict access to administrative paths to trusted networks, for example through a VPN or allow-listing at a reverse proxy.
- Enforce strong account practices for administrators and review privileged accounts for unexpected changes.
- Follow the linked advisories for confirmed fixed-version details.
Detection guidance
- Review web server logs for unusual request volumes to the /admin/check endpoint, especially from a single source or with repeated authentication failures.
- Audit administrative accounts and recent configuration or content changes for signs of unauthorized access.
- Correlate bursts of authentication failures with subsequent successful administrative logins.
Limitations of the available information
The record has no structured affected or fixed version data, and its source status is Deferred. The EPSS values describe likelihood only. The linked GitHub and VulnCheck advisories were not retrieved in this analysis, so their details are not reflected here.
Frequently asked questions
Which phpMyFAQ versions are affected?
The description states that versions before 4.1.2 are affected. The structured affected list in the record is empty, so confirm the exact range in the linked advisories.
Is this vulnerability being actively exploited?
The KEV entry in this record is not listed, and no confirmed active exploitation appears in the sources consulted. Monitor official sources for changes.
What is the recommended first step?
Upgrade phpMyFAQ to 4.1.2 or later. If that is not immediately possible, restrict access to administrative paths to trusted networks.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.