Live › vulnerability › CVE-2026-111882
Go to dashboardphpMyFAQ's Keycloak and Entra ID single sign-on callbacks let an IdP-authenticated user finish login without the TOTP two-factor step. An attacker with a valid or phished IdP identity linked to a 2FA-enabled account gets a fully authenticated session, including administrator accounts.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only installations that use phpMyFAQ's Keycloak or Entra ID SSO login are exposed, and the bypass only matters for accounts that have TOTP two-factor enabled. Sites that log in with local passwords only, or that do not use these SSO providers, can skip it. Anyone running SSO-backed phpMyFAQ on an affected version should patch.
No product ranges from the sources yet.
phpMyFAQ version in the admin panel or composer show phpmyfaq/phpmyfaq; affected are 3.2.0-alpha up to before 4.1.9 and 4.2.0-alpha before 4.2.0-beta4.1.9 or later on the 4.1 line, or to 4.2.0-beta or later on the 4.2 lineEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows IdP-authenticated users to skip TOTP two-factor authentication through the Keycloak and Entra ID SSO callbacks. Attackers holding a valid or phished IdP identity linked to a 2FA-enabled account can complete the OIDC flow and obtain a fully authenticated session, including administrator accounts.
This page as .md · .json · in your agent: get_signal("CVE-2026-111882")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.