{"id":"CVE-2026-76213","aliases":[],"url":"https://o3.security/vulnerability/CVE-2026-76213","summary":"phpMyFAQ before 4.1.7 contains a brute-force vulnerability in the two-factor authentication step where the failure counter is session-scoped and reset on each successful password re-authentication.…","details":"phpMyFAQ before 4.1.7 contains a brute-force vulnerability in the two-factor authentication step where the failure counter is session-scoped and reset on each successful password re-authentication. Attackers with a valid password can bypass the five-attempt limit by obtaining a fresh session cookie and repeatedly re-authenticating to reset the counter, enabling unbounded TOTP code guessing.","published":"2026-08-19T14:17:47.330","modified":"2026-08-19T14:17:47.330","cvss":{"score":7.4,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[],"fix":null,"references":[{"type":"WEB","url":"https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-f98m-hcjv-7rp9"},{"type":"WEB","url":"https://www.vulncheck.com/advisories/phpmyfaq-before-2fa-brute-force-via-session-scoped-throttle"}],"provenance":{"sources":["OSV.dev","NVD","FIRST.org (EPSS)"],"lastVerified":"2026-08-19T14:17:47.330"}}