CVE-2026-76207
High · 8.1CVSS
8.1
EPSS
—
Published
Aug 19, 2026
CISA due date
—
The record
phpMyFAQ before 4.1.7 contains a two-factor authentication bypass vulnerability where remember-me tokens are issued before 2FA verification completes. Attackers with valid credentials can obtain a remember-me cookie, skip the 2FA challenge, and replay the cookie to gain full authenticated access without second-factor verification.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2023-54391 Proxmox Virtual Environment (VE) 7.0 through 8.0 contains an authentication bypass… CWE-304
- CVE-2026-49467 Pingvin Share X is a secure and easy self-hosted file sharing platform. CWE-304
- CVE-2026-61143 Vulnerability in the Oracle Communications Convergent Charging Controller product of… CWE-304
- CVE-2026-57915 It is possible to bypass the Kerberos pre-authentication check in Apache Kerby by sending… CWE-304
- CVE-2026-44547 ChurchCRM is an open-source church management system. CWE-304
- CVE-2026-42452 Termix is a web-based server management platform with SSH terminal, tunneling, and file… CWE-304
- CVE-2026-40542 Missing critical step in authentication in Apache HttpClient 5.6 allows an attacker to… CWE-304
- CVE-2026-30831 Rocket.Chat is an open-source, secure, fully customizable communications platform. CWE-304