GHSA-9pq7-mfwh-xx2j
Critical · 9.1phpMyFAQ enables unauthenticated 2FA brute-force attack via /admin/check acceptance of arbitrary user-id
CVSS
9.1
EPSS
—
Published
May 6, 2026
CISA due date
—
The record
The `/admin/check` endpoint in `AuthenticationController` implements `SkipsAuthenticationCheck`, making it reachable without any prior authentication. An anonymous attacker (Bob) can POST arbitrary `user-id` and `token` values to brute-force any user's 6-digit TOTP code. No rate limiting exists. The 10^6 keyspace is exhaustible in minutes. Reachability confirmed against a default install: unauthenticated `POST /admin/check` with a `user-id` body field returns HTTP 302 to `/admin/token?user-id=<value>`, echoing the attacker-supplied user id without any binding to a prior password-phase authentication.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-89174 Smart Video Intercom System developed by Kingdom Communication Associated has a Missing… CWE-307
- CVE-2026-88770 A flaw was found in the Device Authorization Grant flow of Keycloak, an identity and… CWE-307
- CVE-2026-78490 Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions… CWE-307
- CVE-2026-86729 WWBN AVideo through commit e01e41ecc (no patched version available) exposes… CWE-307
- CVE-2026-20514 In Audio HAL, there is a possible information disclosure due to a missing permission… CWE-307
- CVE-2026-20512 In Audio HAL, there is a possible escalation of privilege due to improper input… CWE-307
- CVE-2026-86186 AVideo API fails to enforce rate limits when clients send a bot User-Agent header… CWE-307
- CVE-2026-85237 A vulnerability in MISP's email-based one-time password (OTP) authentication flow allowed… CWE-307