phpMyFAQ CVE-2026-76207

Exploitation requires two specific conditions to be met: first, the attacker must possess valid first-factor credentials (username and password) for a phpMyFAQ account - PR:L in the CVSS 4.0 vector confirms this low-privilege authentication prerequisite; second, the remember-me feature must be available and used during the authentication flow, since the vulnerability is specifically in the premature issuance of the remember-me token. Deployments where 2FA is enforced are the intended protection target and are precisely those affected. Exploitation is limited to accounts where the attacker already holds the first-factor credentials; this is not exploitable against accounts for which the attacker has no credentials at all. There is no requirement for a specific OS, hosting configuration, or network position beyond the ability to reach the phpMyFAQ login endpoint over the network.

The CVSS 4.0 score of 8.6 (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N) is well-calibrated: network-accessible, low complexity, no availability impact, but high confidentiality and integrity impact reflecting full account takeover potential. The PR:L rating correctly reflects that exploitation requires valid first-factor credentials - this is not an unauthenticated attack. Real-world risk is meaningfully bounded by that prerequisite: an attacker must first possess or compromise a valid username and password before the 2FA bypass becomes useful. This makes the vulnerability most dangerous in scenarios involving credential stuffing, phishing, or prior credential leaks targeting phpMyFAQ user accounts. No CISA KEV listing and no public POC are present, and EPSS data was not provided. Despite the high CVSS score, this is not a fire-drill priority for organizations without phpMyFAQ deployed, and even for affected deployments the risk is conditional on credential exposure - however, for any deployment where 2FA was explicitly enabled to compensate for credential risk, the control is now ineffective and remediation is urgent.

An attacker who has obtained valid phpMyFAQ credentials - through phishing, credential stuffing, or a prior data breach - initiates a login, captures the remember-me cookie issued by the server before the 2FA prompt is presented, and then abandons the login flow without completing the second factor. The attacker subsequently replays the captured cookie in a new HTTP request, gaining full authenticated access to the phpMyFAQ admin or user interface without ever providing a valid TOTP or other second-factor token. No exploit code is required beyond a standard HTTP client capable of storing and replaying cookies.