PT-2026-78389 · Phpmyfaq · Phpmyfaq
CVSS v4.0
8.6
High
| Vector | AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
phpMyFAQ versions prior to 4.1.7
Description
A two-factor authentication (2FA) bypass exists because remember-me tokens are issued before the 2FA verification process is completed. An attacker possessing valid credentials can obtain a remember-me cookie to skip the 2FA challenge and replay that cookie to gain full authenticated access to the system without providing the second-factor verification.
Recommendations
Update to version 4.1.7 or later.
Exploit
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Phpmyfaq