Live › vulnerability › CVE-2026-111895
Go to dashboardphpMyFAQ's Microsoft Entra ID login links users by the mutable preferred_username claim, and it keeps going with an existing local account when a duplicate login is detected. An attacker with an Entra identity in the configured tenant and a matching preferred_username can log in as that local account, including super-admin accounts.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Only installations that run phpMyFAQ with the Microsoft Entra ID login enabled and in the affected version ranges are exposed. The attack needs an identity inside the same Entra tenant the site trusts, so sites that use local logins only, or that trust no Entra tenant, can skip it.
No product ranges from the sources yet.
composer show phpmyfaq/phpmyfaq or the version shown in the admin panel; affected ranges are 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta4.2.0-beta or later (the sources name 4.2.0-beta as the first fixed release for the 4.0.x line; unknown whether a stable 4.x release is fixed)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta contains an authentication bypass in its Microsoft Entra ID login flow, which links users by the mutable preferred_username claim and whose AuthEntraId::create() ignores the duplicate-login exception while continuing with the existing local account. Attackers controlling an Entra identity in the configured tenant with a matching preferred_username can take over that local account, including super-admin accounts.
This page as .md · .json · in your agent: get_signal("CVE-2026-111895")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.