Improper Restriction of Excessive Authentication Attempts in phpMyFAQ - #VU140894
Published: August 4, 2026
Vulnerability details
The vulnerability allows a remote attacker to bypass two-factor authentication and gain access to an administrator account.
The vulnerability exists due to improper restriction of excessive authentication attempts in the authentication controller 2FA flow when handling repeated token submissions across fresh sessions or password re-authentication. A remote attacker can submit repeated guessed TOTP codes to bypass two-factor authentication and gain access to an administrator account.
Exploitation requires knowledge of the victim's password. The failed-attempt counter is tracked only in the session, is reset on successful password authentication, and the token verifier does not record previously tried or previously accepted codes.