{"id":"CVE-2026-111882","kind":"vulnerability","aliases":["CVE-2026-111882"],"related":[],"title":"phpMyFAQ: SSO login skips TOTP two-factor check, granting admin sessions","description":"phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows IdP-authenticated users to skip TOTP two-factor authentication through the Keycloak and Entra ID SSO callbacks. Attackers holding a valid or phished IdP identity linked to a 2FA-enabled account can complete the OIDC flow and obtain a fully authenticated session, including administrator accounts.","summary":"phpMyFAQ's Keycloak and Entra ID single sign-on callbacks let an IdP-authenticated user finish login without the TOTP two-factor step. An attacker with a valid or phished IdP identity linked to a 2FA-enabled account gets a fully authenticated session, including administrator accounts.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["entra-id","keycloak","package","php","phpmyfaq","self-hosted","sso"],"not_affected_if":["local-login-only","no-sso","no-totp-accounts"],"how_to_check":"- Check the installed version: `phpMyFAQ` version in the admin panel or `composer show phpmyfaq/phpmyfaq`; affected are 3.2.0-alpha up to before 4.1.9 and 4.2.0-alpha before 4.2.0-beta\n- Check whether OIDC SSO via Keycloak or Entra ID is enabled in the phpMyFAQ configuration\n- unknown","fix":"- Upgrade phpMyFAQ to `4.1.9` or later on the 4.1 line, or to `4.2.0-beta` or later on the 4.2 line\n- Until patched, disable Keycloak or Entra ID SSO login or enforce a separate second factor at the IdP\n- Rotate passwords and review admin accounts for sessions you did not create","status":"open","published_at":"2026-10-17T19:16:29+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T03:00:03+00:00","updated_at":"2026-10-25T03:00:03+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:00:03Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade phpMyFAQ to `4.1.9` or later on the 4.1 line, or to `4.2.0-beta` or later on the 4.2 line\n- Until patched, disable Keycloak or Entra ID SSO login or enforce a separate second factor at the IdP\n- Rotate passwords and review admin accounts for sessions you did not create","reach":"internet","title":"phpMyFAQ: SSO login skips TOTP two-factor check, granting admin sessions","impact":"high","summary":"phpMyFAQ's Keycloak and Entra ID single sign-on callbacks let an IdP-authenticated user finish login without the TOTP two-factor step. An attacker with a valid or phished IdP identity linked to a 2FA-enabled account gets a fully authenticated session, including administrator accounts.","category":"package","nicknames":[],"who_cares":["phpmyfaq","php","self-hosted","sso","keycloak","entra-id"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker gets administrator session by bypassing TOTP via SSO","analyst_note":"Confirm the exact fixed versions and any vendor advisory text at the NVD entry; sources give only the affected ranges.","how_to_check":"- Check the installed version: `phpMyFAQ` version in the admin panel or `composer show phpmyfaq/phpmyfaq`; affected are 3.2.0-alpha up to before 4.1.9 and 4.2.0-alpha before 4.2.0-beta\n- Check whether OIDC SSO via Keycloak or Entra ID is enabled in the phpMyFAQ configuration\n- unknown","needs_analyst":true,"not_affected_if":["local-login-only","no-sso","no-totp-accounts"],"who_is_affected":"Only installations that use phpMyFAQ's Keycloak or Entra ID SSO login are exposed, and the bypass only matters for accounts that have TOTP two-factor enabled. Sites that log in with local passwords only, or that do not use these SSO providers, can skip it. Anyone running SSO-backed phpMyFAQ on an affected version should patch.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000732,"input_tokens":3410,"output_tokens":782,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-111882':15A,18A '-2026':14A,17A '2fa':69B,129C '2fa-enabled':68B,128C '3.2.0':81C '4.1.9':84C '4.2.0':86C,89C 'account':71B,79B,131C,145C 'admin':11A 'administr':78B,144C 'allow':97C 'alpha':82C,87C 'attack':57B,117C 'authent':45B,75B,93C,100C,108C,141C 'beta':90C 'bypass':94C 'callback':40B,116C 'check':9A 'complet':133C 'contain':91C 'cve':13A,16A 'enabl':70B,130C 'entra':20B,34B,113C 'entra-id':19B 'factor':8A,54B,107C 'finish':47B 'flow':136C 'fulli':74B,140C 'get':72B 'grant':10A 'hold':118C 'host':28B 'id':21B,35B,114C 'ident':64B,124C 'idp':44B,63B,99C,123C 'idp-authent':43B,98C 'includ':77B,143C 'keycloak':22B,32B,111C 'let':41B 'link':65B,125C 'login':3A,48B 'obtain':138C 'oidc':135C 'packag':23B 'phish':62B,122C 'php':24B 'phpmyfaq':1A,25B,30B,80C 'self':27B 'self-host':26B 'session':12A,76B,142C 'sign':38B 'sign-on':37B 'singl':36B 'skip':4A,103C 'sso':2A,29B,115C 'step':55B 'totp':5A,51B,104C 'two':7A,53B,106C 'two-factor':6A,52B,105C 'user':46B,101C 'valid':60B,120C 'vulner':95C 'without':49B","nicknames":[],"mitigations":[],"who_affected":"Only installations that use phpMyFAQ's Keycloak or Entra ID SSO login are exposed, and the bypass only matters for accounts that have TOTP two-factor enabled. Sites that log in with local passwords only, or that do not use these SSO providers, can skip it. Anyone running SSO-backed phpMyFAQ on an affected version should patch.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-17T19:16:29+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111882","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111882","severity":null,"published_at":"2026-10-17T19:16:29+00:00","modified_at":"2026-10-18T13:16:35+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}