CVE-2026-76213

phpMyFAQ before 4.1.7 improperly restricts excessive authentication attempts (CWE-307): the two-factor authentication failure counter is scoped to the session and is reset every time the user successfully re-authenticates with their password. An attacker who already possesses a valid password can therefore bypass the five-attempt limit by repeatedly opening a fresh session and re-submitting the password before each TOTP guess, resetting the counter each time. This enables unbounded guessing of TOTP codes until one is accepted, defeating the second factor and giving the attacker full access to the protected account. Only phpMyFAQ deployments running versions prior to 4.1.7 with TOTP-based two-factor authentication enabled are affected, and the attack requires network access to the login endpoint plus valid user credentials (CVSS 4.0 9.1 Critical, vector AV:N/AC:H/AT:P). There is one public advisory/PoC reference (GHSA-f98m-hcjv-7rp9) but no confirmed in-the-wild exploitation: the flaw is not in CISA KEV and EPSS is 0.3% (26th percentile).

What to do: Upgrade to phpMyFAQ 4.1.7 or later. Until patched, apply rate limiting or lockouts to the login/2FA endpoints at a reverse proxy or WAF, review 2FA failure logs for repeated failures from a single source, and prioritize accounts with potentially compromised passwords, since exploitation requires a valid password.