---
id: CVE-2026-56737
title: phpMyFAQ is an open source FAQ web application
summary: >-
  phpMyFAQ is an open source FAQ web application. Versions 3.2.0 through 4.1.5
  contain an authentication bypass in its public two-factor authentication
  verification flow: an unauthenticated attacker can submit an account’s numeric
  user ID …
severity: high
cvss: 8.1
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'
cwe:
  - CWE-287
vendor: thorsten
product: phpMyFAQ
affected:
  - 'phpMyFAQ >= 3.2.0, < 4.1.6'
published: '2026-09-24'
updated: '2026-09-24'
sourceUpdated: '2026-09-24T16:17:07.770'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-56737'
references:
  - url: >-
      https://github.com/thorsten/phpMyFAQ/commit/410208b90f1d01534812ac5203d3e8d9c7bd591f
    label: security-advisories@github.com
  - url: >-
      https://github.com/thorsten/phpMyFAQ/commit/5097dff341fb01e93e8561e7261b3ae657df715a
    label: security-advisories@github.com
  - url: >-
      https://github.com/thorsten/phpMyFAQ/commit/6a69f6e2142fde722165c65b7e0a49f3176e87be
    label: security-advisories@github.com
  - url: >-
      https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-8gpw-xvpf-hvx5
    label: security-advisories@github.com
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-56737'
  - url: 'https://github.com/thorsten/phpMyFAQ/releases/tag/4.1.6'
  - url: 'https://github.com/advisories/GHSA-8gpw-xvpf-hvx5'
tags:
  - nvd
  - cve.org
  - ghsa
  - composer
ingestedAt: '2026-09-24T15:45:56.675Z'
aliases:
  - GHSA-8gpw-xvpf-hvx5
ecosystem: composer
patched:
  - thorsten/phpmyfaq 4.1.6
  - phpmyfaq/phpmyfaq 4.1.6
epss: 0.00399
epssPercentile: 0.31388
---

## Overview

phpMyFAQ is an open source FAQ web application. Versions 3.2.0 through 4.1.5 contain an authentication bypass in its public two-factor authentication verification flow: an unauthenticated attacker can submit an account’s numeric user ID and a valid or brute-forced six-digit TOTP code without first authenticating with the account password, allowing takeover of any 2FA-enabled account, including administrator accounts. Version 4.1.6 is patched by binding TOTP verification to a session established after successful password authentication and limiting failed TOTP attempts. No official workaround is documented; affected installations should upgrade to 4.1.6 or later.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-56737)

Affected packages:

- `thorsten/phpmyfaq >= 3.2.0, < 4.1.6`
- `phpmyfaq/phpmyfaq >= 3.2.0, < 4.1.6`

Patched in:

- `thorsten/phpmyfaq 4.1.6`
- `phpmyfaq/phpmyfaq 4.1.6`

Source: https://github.com/advisories/GHSA-8gpw-xvpf-hvx5