Description
phpMyFAQ before 4.1.7 contains a brute-force vulnerability in the two-factor authentication step where the failure counter is session-scoped and reset on each successful password re-authentication. Attackers with a valid password can bypass the five-attempt limit by obtaining a fresh session cookie and repeatedly re-authenticating to reset the counter, enabling unbounded TOTP code guessing.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| thorsten | phpMyFAQ | < 4.1.7 | 4.1.7 |
References
- GitHub Security Advisory (GHSA-f98m-hcjv-7rp9) vendor-advisory
- VulnCheck Advisory: phpMyFAQ before 4.1.7 2FA Brute-Force via Session-Scoped Throttle third-party-advisory