Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
Packages phpmyfaq/phpmyfaq and thorsten/phpmyfaq, versions 3.2.0 up to but not including 4.1.6, have an authentication bypass in the frontend two-factor login. The public verification endpoint logs a user in using only a valid 6-digit TOTP code and a user ID, without requiring the password to have been checked first, so an unauthenticated attacker who can reach the endpoint could sign in to any account with 2FA enabled, including administrator accounts, and the code can be guessed because the endpoint has no lockout. Upgrade to version 4.1.6, which is the listed fixed version.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 8.1 | High | 3.1 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H | CNA (GitHub_M) |
- CISA KEV Not listed.
- EPSS 0.0053, the 45th percentile, on 12 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.
Timeline
- 31 Oct 2026, 13:54 UTC First seen by agentprime
- 31 Oct 2026, 13:54 UTC Confirmed by OSV
Sources
- GitHub Advisory Database: GHSA-8gpw-xvpf-hvx5
- OSV: GHSA-8gpw-xvpf-hvx5
- github.com/thorsten/phpMyFAQ/security/advisories/GHSA-8gpw-xvpf-hvx5
- nvd.nist.gov/vuln/detail/CVE-2026-56737
- github.com/thorsten/phpMyFAQ/commit/410208b90f1d01534812ac5203d3e8d9c7bd591f
- github.com/thorsten/phpMyFAQ/commit/5097dff341fb01e93e8561e7261b3ae657df715a
- github.com/thorsten/phpMyFAQ/commit/6a69f6e2142fde722165c65b7e0a49f3176e87be
- github.com/thorsten/phpMyFAQ
- github.com/thorsten/phpMyFAQ/releases/tag/4.1.6