CVE-2026-85590

The record

phpMyFAQ before 4.1.8 contains an authentication bypass vulnerability in its two-factor authentication (TOTP) disable functionality. The removeTwofactorConfig() handler (reachable via POST /api/user/remove-twofactor) verifies only that the user is logged in and that a valid CSRF token is supplied, then disables TOTP without requiring password re-entry or a current TOTP code. The same downgrade is also reachable inline via PUT /api/user/data/update, which accepts a plain twofactor_enabled form field under the same session+CSRF-only guard. An attacker who has hijacked a user's session can silently strip two-factor protection from any account, including administrator accounts, after which password-only authentication succeeds.

Affected packages

Related vulnerabilities

• CVE-2026-58240 SAP NetWeaver Message Server does not sufficiently validate the authenticity of internal… CWE-308
• CVE-2026-67611 OpenEMR through 8.2.0 contains an authentication bypass vulnerability that allows… CWE-308
• CVE-2026-56022 Webmin accepts basic authentication without session cookies when an attacker provides the… CWE-308
• CVE-2024-27928 vantage6 is an open-source infrastructure for privacy preserving analysis. CWE-308
• CVE-2026-45749 Termix is a web-based server management platform with SSH terminal, tunneling, and file… CWE-308
• CVE-2026-33550 SOGo before 5.12.5 does not renew the OTP if a user disables/enables it, and has a too… CWE-308
• CVE-2024-50618 A Use of Single-factor Authentication vulnerability in the Authentication component of… CWE-308
• CVE-2025-64103 Zitadel May Bypass Second Authentication Factor CWE-308