CVE-2026-85590

Executive Summary

CVE-2026-85590 is a critical authentication-bypass vulnerability in phpMyFAQ versions prior to and including 4.1.7 (fixed in 4.1.8). The flaw exists in the two-factor authentication (TOTP) removal mechanism, where the application's removeTwofactorConfig() handler — reachable via POST /api/user/remove-twofactor — and an inline alternative via PUT /api/user/data/update (accepting a twofactor_enabled form field), verify only that the user is logged in and that a valid CSRF token is supplied. Neither endpoint requires password re-entry or a current TOTP code before disabling the TOTP protection. An attacker who has achieved session hijacking of any authenticated user — including an administrator — can silently strip all 2FA from the account, allowing subsequent password-only authentication. This effectively nullifies the security value of the second authentication factor. No CVE description explicitly associates CVE-2026-85590 with any real-world TOTP-based authentication provider. The CVSS score remains N/A as no score has been assigned.

Technical Analysis

The vulnerability is classified under CWE-308 — Use of Single-factor Authentication. The core issue is the reliance on a single authentication factor (session cookies) to authorize a security-sensitive operation (disabling TOTP) rather than performing step-up authentication. Since the endpoint is able to disable TOTP with only what the NVD description explicitly names — a user logged in and a valid CSRF token — session hijacking becomes sufficient to permanently degrade the account's security posture.

The official NVD/CNA description provides the following details:

• The application shall carry out session-based authentication via sessions for the phpMyFAQ admin panel (www.example.com/phpmyfaq/admin). The authentication state check is restricted to verifying the user is logged in, at the most basic logged-in session level. There is no additional password re-entry or TOTP challenge.
• The CSRF token in requests to this endpoint is the only additional requirement. For specific handling of CSRF, multi-step configurations or dedicated protections used for phpMyFAQ variants will not matter — the handler is available on standard POST and PUT requests to the API.
• The description details two distinct pathways for the TOTP stripping to be performed:
  1. Direct endpoint removal: Via POST /api/user/remove-twofactor, the handler removeTwofactorConfig() is called, which disables TOTP configuration for the logged-in user.
  2. Inline downgrade: Via PUT /api/user/data/update. The payload includes a conventional form field twofactor_enabled which is also processed.

In both cases, the context is session authenticity. Assuming a legitimate TOTP setup flow to have been performed previously, removeTwofactorConfig() effectively disables the database-stored TOTP secret/config so the code is no longer presented as a requirement at login.

The mechanism is fundamentally broken access control / authorization. A conditional check occurs to determine "is authenticated", however the descriptor "authenticated" is equivalent to "a valid session cookie". The action "disable two-factor" is seen as equivalent to a benign update operation, rather than a critical security event. Critically, no re-authentication (password) and no possession-factor (TOTP) challenge is presented.

Affected entity: All instances of phpMyFAQ running version prior to 4.1.8 which have TOTP enabled and expose the /api/ user endpoints. Because affected versions store the TOTP state in a persistent manner, this vulnerability impacts both cloud and on-premise installations of the same version.

Patch confidence: 0/4. No source referenced in any tracked database has confirmed a patch. The version that fixes this is noted in CNA/NVD as 4.1.8 — the fix appears in versions unreferenced in the CVE data. Per current data (given by NVD and the CNA), there is a version "4.1.8" considered the next release after the vulnerable versions with the description naming "before 4.1.8". Since no CVE description or vendor URLs detail exact fixes, no third-party or first-party confirmation exists for precise patch/patch extent; the information comes directly from the NVD description. No patch source is supplied from the OSV packages listing, no git commit from the vendor's code repository, no official phpmyfaq.de security announcement offered.

Exploitation Scenarios

Preconditions (attack Path):

• The victim must have a valid session in phpMyFAQ 4.1.7 or lower.
• The victim must have TOTP enabled on their account (else there is none to strip).
• The attacker must have previously performed a session hijacking (stolen the session token/cookie) via any method that does not involve the second factor (e.g., XSS, network sniffing, session fixation, or malware on victim's endpoint).

Reconnaissance / target identification: An attacker identifies phpMyFAQ target instances (server may be discovered via HTTP headers, footer text "Powered by phpMyFAQ", or the specific URL path /api/), then confirms the active version is ≤ 4.1.7 by searching the backend's publicly accessible version.php or release notes. For the second factor, the attacker identifies the user session by capturing session cookies.

Attack mechanism:

1. Compromise Session: The attacker steals a valid session cookie from a victim who is an administrative user and has TOTP enabled. This can happen via:

   • Cross-site scripting (XSS) with a crafted script that exfiltrates the phpMyFAQ session cookie.
   • Passive network sniffing on unencrypted HTTP (if HTTPS is not enforced).

2. Trigger the flaw: The attacker sends a request to the server. Example (source-level class detail available from description):

   POST /api/user/remove-twofactor
   

   Headers: Cookie: PHPSESSID=<stolen_session>, X-CSRF-Token: <valid_token>.

   The CSRF token is obtainable because the attacker, posing as an authenticated user via their session, can query the token from any normal page within the authenticated UI without raising alarms.

   Alternatively the attacker issues:

   PUT /api/user/data/update
   

   Body: twofactor_enabled=0 (or not included — only a plain field; TOTP may still be stripped by an implied "enabled" logic defined by the handler).

3. Session guard passes: The server validates the session and CSRF token are present; both are. The request proceeds, engaging removeTwofactorConfig().

4. Effect: Database flag/record for twofactor_enabled is removed/disabled, and TOTP secret invalidated. The account no longer requires a one-time password at login.

5. Post-exploitation: The attacker ends their session. The next login for that admin user with password alone fully authenticates. The attacker logs in (assuming they know/know password, or perform a subsequent password brute force). Attackers also might retain full session control and escalate privileges to the now-degraded admin account.

Note on data provided: While exact code inside removeTwofactorConfig() is not provided in the CVE description beyond its path, we can reasonably infer it disables the TOTP configuration. No public PoC exists at time of this report. The attack chain above is inferred from vulnerability class and mechanics described in NVD description, not from a published exploit.

Impact Assessment

Confidentiality: High — session hijack on an administrator permits the attacker to strip 2FA, then gain full administrative access to phpMyFAQ — exposing category archives, support/facts, and system integration data such as email settings, SMTP credentials, and potentially user databases (the phpMyFAQ back-end). TOTP removal undermines the protection that guards administrator accounts in cases where password has been previously compromised or brute-forced later.

Integrity: High — with administrative access, configuration changes to the FAQ may be made directly.

Availability: High — a compromised admin can disable the entire FAQ service, export/delete stored knowledge, or set configuration to cause denial of service.

CVSS Subscore: N/A. No CVSS vector is provided. However, based on AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H for session-hijack scenario, ~8.8 high.

Blast Radius:

• Type: server-side application.
• All deployments running 4.1.7 and older.
• Attack impact compounded by the fact that TOTP is perceived as an all-around security net; its removal isn't logged or alerted natively within the application, hiding malicious activity from administrators.

CISA KEV: Not listed at time of publication — no known in-the-wild exploitation has been confirmed.

Detection Guidance

The following detection analytics assume you have visibility into application logs (REST API), which include user_id, request_uri, status_code, method, and the presence of X-CSRF-Token.

Sigma Rule

title: phpMyFAQ TOTP Disable Attempt (CVE-2026-85590)
id: 2fa30f8d-4a6f-4f1e-9e47-6f4eea5f119b
status: experimental
description: Detects a single user disabling TOTP through phpMyFAQ API without proper multi-factor step-up authorization.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-85590
author: Valters IT Cyber Defense Team
date: 2026/11/22
logsource:
    category: application
    product: phpmyfaq
    definition: 'phpMyFAQ web application logs, configured with application-level access.'
detection:
    selection_remove_endpoint:
        cs-method: 'POST'
        cs-uri-query|contains:
            - '/api/user/remove-twofactor'
    selection_update_endpoint:
        cs-method: 'PUT'
        cs-uri-query|contains:
            - '/api/user/data/update'
    selection_totp_disable:
        cs-uri-query|contains: 'twofactor_enabled'
        cs-uri-query|contains: '0'
    condition: (selection_remove_endpoint) or (selection_update_endpoint and selection_totp_disable)
level: medium
falsepositives:
    - Legitimate user disabling 2FA without step-up validation - in rare cases, users may have legitimate reasons.
fields:
    - c-ip
    - cs-username
    - cs-method

YARA Rule

rule phpMyFAQ_TOTP_Disable_Payload_CVE_2026_85590
{
    meta:
        author = "ValtersIT"
        date = "2026-11-22"
        description = "Detects HTTP requests attempting to disable TOTP two-factor authentication on phpMyFAQ via API"
        reference = "CVE-2026-85590"
        severity = "high"
    strings:
        $s1 = "/api/user/remove-twofactor" ascii nocase
        $s2 = "twofactor_enabled" ascii nocase
        $s3 = "removeTwofactorConfig()" ascii nocase
        $s4 = "/api/user/data/update" ascii nocase
    condition:
        // HTTP body/URI capture at proxy level
        any of ($s1, $s2, $s3, $s4)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (
    msg:"ET EXPLOIT phpMyFAQ TOTP Disable Attempt (CVE-2026-85590)";
    flow:established,to_server;
    http.method;
    content:"POST";
    http.uri;
    content:"/api/user/remove-twofactor";
    sid:8559001;
    rev:1;
    metadata:created_at 2026_11_22, updated_at 2026_11_22, mitre_attack_technique T1556.006;
)

A second rule to catch the PUT on /api/user/data/update, including body check with HTTP body rule:

alert http any any -> $HOME_NET any (
    msg:"ET EXPLOIT phpMyFAQ TOTP Disable via PUT (CVE-2026-85590)";
    flow:established,to_server;
    http.method;
    content:"PUT";
    http.uri;
    content:"/api/user/data/update";
    http.client_body;
    content:"twofactor_enabled";
    sid:8559002;
    rev:1;
)

Elastic Detection

The EQL rule will detect multi-step actions from a single user: performing a PUT or POST to change TOTP setting in quick succession, or repeated removal attempts.

sequence by user.name with maxspan=5m
  [any where process.name == "php-cgi.exe" or event.category == "web"]
  [any where url.path == "/api/user/remove-twofactor" and http.request.method == "POST"]
  [any where url.path == "/api/user/data/update" and http.request.body.content contains "twofactor_enabled" and http.request.body.content contains "0"]

Alternatively a more containment-safe rule:

any where event.category == "web" and url.path == "/api/user/remove-twofactor"

Splunk SPL Query

index=web sourcetype=access_combined
    OR index=phpmyfaq sourcetype=phpmyfaq_api
    (uri="/api/user/remove-twofactor" OR uri="/api/user/data/update")
    | table _time clientip user uri status
    | transaction clientip maxspan=2m
    | stats count by user uri
    | where uri like "%twofactor%"

Wazuh OSSEC Rule

<group name="web, access_control,">
  <rule id="591904" level="10">
    <decoded_as>json</decoded_as>
    <field name="url">/api/user/remove-twofactor</field>
    <description>phpMyFAQ: TOTP removal attempted without step-up auth - CVE-2026-85590</description>
    <group>authentication,bypass,</group>
  </rule>
  <rule id="591905" level="8">
    <decoded_as>json</decoded_as>
    <field name="url">/api/user/data/update</field>
    <field name="data" type="string">twofactor_enabled</field>
    <description>phpMyFAQ: TwoFactor update request to /api/user/data/update</description>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED = No patch evidence from any of the tracked sources at time of this report. The only reference to a possible fixed version is “phpMyFAQ before 4.1.8”, suggesting phpMyFAQ 4.1.8 contains the resolution — however no vendor patch URL, diff, or advisory is available in the CVE data, so do not consider this a formal patch release yet.

Immediate Mitigations (at network/application level):

1. Temporarily disable TOTP removal endpoints — For installations where possible, remove permissions or restrict route access so that /api/user/remove-twofactor and updates to /api/user/data/update from this endpoint are blocked at the reverse proxy for all requests. This can be done via e.g., location controls in nginx; this is an emergency stop-gap.
2. Enforce additional two-factor for administrative changes — If code-level patch is not available, apply a WAF rule via ModSecurity/CRS that requires X-Auth-Second-Factor header which must be set — even if phantom — so that failing the check blocks the request.
3. Strengthen session management — Ensure session cookies have Secure and HTTPOnly flags; enforce HTTPS only to mitigate passive session intercept attack.
4. Block stale sessions — a periodic session timeout (e.g., 15 min) to reduce session hijack time.
5. As the vulnerability relies on an active session, restrict VLAN access / zero-trust model. Disable sessions from unrecognized IPs or geo-locations with enforcement of MFA at perimeter.

Patch/Upgrade steps:

1. Wait for official advisory phpmyfaq.de/security/advisories detailing the contents of release 4.1.8. As soon as it is available in a changelog, upgrade all phpMyFAQ installations to version >= 4.1.8. This is the only real destination fix.
2. Update even if no changes are seen on patch diff: at minimum, the fix must require TOTP or password for delete/removal operation.
3. Before upgrade, back up the database and the configuration/session tables.
4. If no immediate public upgrade, track source code recommendations.

Long-term hardening:

1. Review all endpoints that change auth-related settings and apply step-up authentication. Protect the functions with a policy of revalidate session: recent_password + possession.
2. Implement a defense-in-depth strategy: audit logging that triggers alerts on TOTP config change, and require a two-person rule for admin accounts.
3. Use Content-Security-Policy to mitigate XSS vectors that lead to session hijack.
4. For any sensitive application — the CWE-308 pattern is solved by implementing multi-factor challenge in "sensitive actions" (like the removal of MFA).

References

1. NVD Entry — CVE-2026-85590: https://nvd.nist.gov/vuln/detail/CVE-2026-85590 — (Contains basic description, yet no CVSS/EPSS)
2. phpMyFAQ Vendor site (as future advisory source): https://www.phpmyfaq.de/ — no published advisory for this CVE yet; release notes for v4.1.8 will reflect fix.
3. CWE-308 Entry, MITRE: https://cwe.mitre.org/data/definitions/308.html — Use of Single-factor Authentication (class for this CVE)
4. ATT&CK Technique T1556.006 — Modify Authentication Process: Multi-Factor Authentication — likely chain mapping for this vulnerability class. https://attack.mitre.org/techniques/T1556/006/
5. CISA Known Exploited Vulnerability Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CVE-2026-85590 not listed (as of 2026-11-22).

No known threat actor campaigns or public exploit attempts have been reported at the date of this report.