phpMyFAQ's two-factor authentication login bypasses the password factor

Summary

The public two-factor verification endpoint POST /check logs a user in based solely on a valid 6-digit TOTP token and a chosen user-id. It does not require — and is not bound to — a prior successful password authentication. For any account that has 2FA enabled, an unauthenticated attacker can authenticate without knowing the password, reducing the account to a single factor (a 6-digit code) that is itself brute-forceable because this endpoint has no lockout (see Finding #2). This is an authentication bypass of the primary credential for all 2FA-protected accounts, including administrators.

Details

src/phpMyFAQ/Controller/Frontend/AuthenticationController.php:255-283:

#[Route(path: '/check', name: 'public.auth.check', methods: ['POST'])]
public function check(Request $request): RedirectResponse
{
    if ($this->currentUser->isLoggedIn()) {
        return new RedirectResponse(url: './');
    }

    $token  = Filter::filterVar($request->request->get('token'), FILTER_SANITIZE_SPECIAL_CHARS);
    $userId = (int) Filter::filterVar($request->request->get('user-id'), FILTER_VALIDATE_INT);

    if ($userId <= 0) { /* ... */ }

    $this->currentUserService->getUserById($userId);          // loads attacker-chosen user

    if (strlen((string) $token) === 6) {
        $result = $this->twoFactor->validateToken($token, $userId);
        if ($result) {
            $this->currentUserService->twoFactorSuccess();    // full login, no password ever checked
            return new RedirectResponse(url: './');
        }
    }
    // ...
}

twoFactorSuccess() performs a complete session login (src/phpMyFAQ/User/CurrentUser.php:239-247):

public function twoFactorSuccess(): bool
{
    $this->setLoggedIn(true);
    $this->updateSessionId(true);
    $this->saveToSession();
    $this->setSuccess(true);
    return true;
}

There is no server-side state (such as a "password already verified for this user" flag) tying the /check step to the password step. Compare the admin flow, which does it correctly via a 2fa_pending_user_id session value set only after the password is validated (src/phpMyFAQ/Controller/Administration/AuthenticationController.php:218-262) — proving the frontend omission is a regression, not an intended design.

validateToken() (src/phpMyFAQ/User/TwoFactor.php:87-101) returns false when the user has no secret, so this is not a universal bypass of all accounts — it specifically defeats the :