CVE-2026-85590: phpMyFAQ 2FA Bypass Vulnerability

CVE-2026-85590 Overview

CVE-2026-85590 is an authentication bypass vulnerability in phpMyFAQ versions before 4.1.8. The flaw resides in the two-factor authentication (TOTP) disable functionality, which fails to require step-up verification. An attacker who has hijacked a valid user session can silently disable TOTP protection on any account, including administrators. Once two-factor authentication is stripped, password-only login succeeds against the targeted account. The issue is tracked under [CWE-308: Use of Single-Factor Authentication].

Critical Impact
Session-riding attackers can disable TOTP on administrator accounts without knowing the password or current TOTP code, then log in with credentials alone.

Affected Products

phpMyFAQ versions prior to 4.1.8
removeTwofactorConfig() handler exposed via POST /api/user/remove-twofactor
Inline downgrade path exposed via PUT /api/user/data/update

Discovery Timeline

2026-09-04 - CVE-2026-85590 published to NVD
2026-09-08 - Last updated in NVD database

Technical Details for CVE-2026-85590

Vulnerability Analysis

phpMyFAQ implements TOTP as a second authentication factor for user accounts. The security model assumes that disabling TOTP is a sensitive operation that should require re-authentication. In versions before 4.1.8, the server enforces only two conditions before disabling TOTP: an authenticated session and a valid CSRF token. Neither password re-entry nor a current TOTP code is required.

An attacker who obtains a session cookie via cross-site scripting, session fixation, or a stolen browser session can call the disable endpoint directly. The application accepts the request and clears the TOTP secret on the target account. Subsequent login attempts against that account require only the username and password.

Root Cause

The root cause is missing step-up authentication on state-changing security operations. The removeTwofactorConfig() handler treats TOTP removal as a routine profile update rather than a security-sensitive action. The same weakness exists in the profile update endpoint, which accepts a twofactor_enabled form field under the same session-plus-CSRF guard. CSRF tokens prevent cross-origin abuse but provide no assurance that the legitimate account owner authorized the change.

Attack Vector

Exploitation requires a hijacked session on the target phpMyFAQ instance. The attacker issues either a POST to /api/user/remove-twofactor or a PUT to /api/user/data/update with twofactor_enabled set to a disabling value. Both requests include the session cookie and the CSRF token accessible from the authenticated context. The server processes the request and disables TOTP. The attacker then authenticates using previously obtained or subsequently phished credentials without triggering the second factor.

No verified public exploit code is available at this time. Technical details are documented in the GitHub Security Advisory GHSA-h96g-59xp-7r5m and the VulnCheck Advisory for phpMyFAQ.

Detection Methods for CVE-2026-85590

Indicators of Compromise

Requests to POST /api/user/remove-twofactor that are not immediately preceded by a password prompt or TOTP challenge in the same session.
PUT /api/user/data/update requests containing a twofactor_enabled field set to a disabling value.
Successful logins to accounts whose TOTP status transitioned from enabled to disabled within a short time window.
User profile audit records showing TOTP removal without a corresponding administrative change request.

Detection Strategies

Alert on any two-factor disable event initiated from a session whose source IP or user agent differs from the account's historical baseline.
Correlate TOTP removal events with subsequent successful password-only logins on the same account within minutes.
Flag high-privilege accounts (administrators, editors) that experience TOTP state changes for manual review.

Monitoring Recommendations

Enable phpMyFAQ audit logging and forward events to a centralized logging pipeline for retention and analysis.
Instrument the web server or reverse proxy to log request methods, paths, and parameter names for /api/user/* endpoints.
Track baseline session behavior per account and alert on deviations, particularly around security-configuration endpoints.

How to Mitigate CVE-2026-85590

Immediate Actions Required

Upgrade all phpMyFAQ deployments to version 4.1.8 or later.
Audit accounts, especially administrators, for unexpected TOTP disable events since the vulnerable versions were deployed.
Force password resets and re-enroll TOTP for any account showing suspicious two-factor state changes.
Invalidate active sessions after upgrading to eliminate any hijacked cookies.

Patch Information

The phpMyFAQ maintainers addressed the issue in version 4.1.8. Refer to the GitHub Security Advisory GHSA-h96g-59xp-7r5m for the fix commit and remediation notes. Administrators should verify that upgraded instances reject TOTP disable requests without step-up authentication.

Workarounds

Restrict access to /api/user/remove-twofactor and /api/user/data/update at the reverse proxy until the upgrade is applied.
Enforce short session lifetimes and rotate session identifiers after privilege-sensitive actions to reduce session hijacking exposure.
Deploy content security policy (CSP) headers to reduce the risk of session theft via cross-site scripting.

bash

# Example nginx restriction blocking the vulnerable endpoints pre-patch
location = /api/user/remove-twofactor {
    return 403;
}

location = /api/user/data/update {
    limit_except GET {
        deny all;
    }
}