What is GHSA-6626-79jh-5ccr?

GHSA-6626-79jh-5ccr is a security advisory published by GitHub Security Advisories with Critical severity. Duplicate Advisory: phpMyFAQ enables unauthenticated 2FA brute-force attack via /admin/check acceptance of arbitrary user-id

Why does GHSA-6626-79jh-5ccr have no CVE ID yet?

GitHub Security Advisories published this advisory directly to customers before NVD assigned a CVE ID. This is the embargo-window disclosure pattern — vendors notify customers on day 0; NVD's public record follows days to weeks later.

What is the CVSS v3 score of GHSA-6626-79jh-5ccr?

GHSA-6626-79jh-5ccr has a CVSS v3 base score of 9.1, published by GitHub Security Advisories.

Which products are affected by GHSA-6626-79jh-5ccr?

GHSA-6626-79jh-5ccr affects 2 products, including: composer/thorsten/phpmyfaq:\u003c 4.1.2; composer/phpmyfaq/phpmyfaq:\u003c 4.1.2.

⚠ Withdrawn by GitHub Security Advisories

Withdrawn: June 9, 2026

GHSA-6626-79jh-5ccrCriticalCVSS 9.1Disclosed before NVD

Duplicate Advisory: phpMyFAQ enables unauthenticated 2FA brute-force attack via /admin/check acceptance of arbitrary user-id

Vendor

GitHub Security Advisories

Published

May 15, 2026

Last Modified

June 9, 2026

📋 Description

Duplicate Advisory

This advisory has been withdrawn because it is a duplicate of GHSA-9pq7-mfwh-xx2j. This link is maintained to preserve external references.

Original Description

phpMyFAQ before 4.1.2 contains an improper restriction of excessive authentication attempts vulnerability in the /admin/check endpoint, which accepts arbitrary user-id parameters without session binding or rate limiting. Unauthenticated attackers can brute-force any user's six-digit TOTP code by submitting POST requests with sequential token values, bypassing two-factor authentication to gain full administrative access.

🎯 Affected products2

composer/thorsten/phpmyfaq:< 4.1.2
composer/phpmyfaq/phpmyfaq:< 4.1.2

📋 Description

Duplicate Advisory

Original Description

🎯 Affected products2

🔗 References (4)