CyberRota Analysis
AI-GeneratedphpMyFAQ versions prior to 4.1.7 are susceptible to a brute-force vulnerability in the two-factor authentication process, where the failure counter is session-scoped and resets with each successful password re-authentication. This flaw allows attackers with valid passwords to bypass the five-attempt limit by obtaining a new session cookie, facilitating unlimited guessing of TOTP codes. Organizations using affected versions should prioritize patching to mitigate the risk of unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
phpMyFAQ before 4.1.7 contains a brute-force vulnerability in the two-factor authentication step where the failure counter is session-scoped and reset on each successful password re-authentication. Attackers with a valid password can bypass the five-attempt limit by obtaining a fresh session cookie and repeatedly re-authenticating to reset the counter, enabling unbounded TOTP code guessing.
Related CVEs
Other vulnerabilities affecting the same vendor(s)