Answer in brief
CVE-2026-56737 records a High severity (CVSS 8.1) vulnerability in phpMyFAQ's two-factor authentication login bypasses the password factor. The current sources do not mark it as known exploited. The current feed maps phpmyfaq/phpmyfaq (composer), thorsten/phpmyfaq (composer), thorsten/phpMyFAQ (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 8.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps phpmyfaq/phpmyfaq (composer), thorsten/phpmyfaq (composer), thorsten/phpMyFAQ (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| phpmyfaq/phpmyfaqcomposer | >=3.2.0,<4.1.6 | 4.1.6 |
| thorsten/phpmyfaqcomposer | >=3.2.0,<4.1.6 | 4.1.6 |
| thorsten/phpMyFAQgeneric | >=3.2.0 <4.1.6 | 4.1.6 |
Published upstream
Sep 24, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 24, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Sep 25, 2026
phpMyFAQ is an open source FAQ web application. Versions 3.2.0 through 4.1.5 contain an authentication bypass in its public two-factor authentication verification flow: an unauthenticated attacker can submit an account’s numeric user ID and a valid or brute-forced six-digit TOTP code without first authenticating with the account password, allowing takeover of any 2FA-enabled account, including administrator accounts. Version 4.1.6 is patched by binding TOTP verification to a session established after successful password authentication and limiting failed TOTP attempts. No official workaround is documented; affected installations should upgrade to 4.1.6 or later.
Quoted source text, attributed separately from HOL analysis.