CVE-2026-76207

Name of the Vulnerable Software and Affected Versions phpMyFAQ versions prior to 4.1.7

Description A two-factor authentication (2FA) bypass exists because remember-me tokens are issued before the 2FA verification process is completed. An attacker possessing valid credentials can obtain a remember-me cookie to skip the 2FA challenge and replay that cookie to gain full authenticated access to the system without providing the second-factor verification.

Recommendations Update to version 4.1.7 or later.