Description
phpMyFAQ before 4.1.7 contains a two-factor authentication bypass vulnerability where remember-me tokens are issued before 2FA verification completes. Attackers with valid credentials can obtain a remember-me cookie, skip the 2FA challenge, and replay the cookie to gain full authenticated access without second-factor verification.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| thorsten | phpMyFAQ | < 4.1.7 | 4.1.7 |
References
- GitHub Security Advisory (GHSA-hvj7-4fmg-53cr) vendor-advisory
- VulnCheck Advisory: phpMyFAQ before 4.1.7 2FA Bypass via Remember-Me Cookie third-party-advisory