Authentication Bypass in phpMyFAQ Affecting SSO Implementations by Keycloak and Entra ID

CVE-2026-111882

What is CVE-2026-111882?

An authentication bypass vulnerability exists in phpMyFAQ versions prior to 4.1.9 and 4.2.0-beta, allowing attackers with valid or compromised identities linked to two-factor authenticated accounts to circumvent TOTP verification. This weakness is exploited through the Keycloak and Entra ID SSO callbacks, enabling unauthorized access to fully authenticated sessions, including those of administrator accounts, thereby posing a significant security risk to users and data integrity.

References