CVE-2026-45010 thorsten CVE debrief

Who should care

Organizations running phpMyFAQ, especially installations that expose the admin interface to the internet or use TOTP-based two-factor authentication for administrator accounts. Security teams, application owners, and incident response teams should treat this as a high-priority authentication weakness.

Technical summary

According to the supplied disclosure, phpMyFAQ versions before 4.1.2 expose an improper restriction of excessive authentication attempts in /admin/check. The endpoint accepts arbitrary user-id values, does not bind the verification flow to the authenticated session, and lacks effective rate limiting. That combination allows repeated POST requests with sequential token guesses against a target user's six-digit TOTP, making 2FA brute force feasible from an unauthenticated position. NVD metadata in the source corpus lists the weakness as CWE-307 and shows a CVSS v3.1 vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N.

Defensive priority

Critical. This is a remotely reachable, unauthenticated authentication bypass that can lead to full administrative compromise. Remediation should be prioritized immediately on any exposed phpMyFAQ instance.

Recommended defensive actions

• Upgrade phpMyFAQ to version 4.1.2 or later.
• Review whether the /admin/check endpoint is reachable from untrusted networks and restrict access where possible.
• Verify that administrator TOTP checks are bound to the active session and target user context, not arbitrary user-id input.
• Add or confirm effective rate limiting, lockout, and monitoring on authentication and 2FA verification endpoints.
• Audit administrator accounts and recent logins for signs of brute-force activity or unauthorized access.
• If exposure is suspected, rotate administrator credentials and review application and reverse-proxy logs for repeated /admin/check requests.

Evidence notes

The source corpus describes the issue as affecting phpMyFAQ before 4.1.2 and cites an unauthenticated brute-force path through /admin/check that can bypass two-factor authentication. The provided NVD metadata lists CWE-307 and CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. NVD metadata in the corpus also shows vulnStatus: Deferred. The published and modified timestamps supplied for the CVE are 2026-05-15T19:17:01.450Z and 2026-05-18T17:25:39.493Z.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.