{"id":"CVE-2026-111895","kind":"vulnerability","aliases":["CVE-2026-111895"],"related":[],"title":"phpMyFAQ: Entra ID login lets attacker take over local accounts","description":"phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta contains an authentication bypass in its Microsoft Entra ID login flow, which links users by the mutable preferred_username claim and whose AuthEntraId::create() ignores the duplicate-login exception while continuing with the existing local account. Attackers controlling an Entra identity in the configured tenant with a matching preferred_username can take over that local account, including super-admin accounts.","summary":"phpMyFAQ's Microsoft Entra ID login links users by the mutable preferred_username claim, and it keeps going with an existing local account when a duplicate login is detected. An attacker with an Entra identity in the configured tenant and a matching preferred_username can log in as that local account, including super-admin accounts.","severity":"high","cvss":7.6,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["microsoft-entra-id","package","php","phpmyfaq","sso"],"not_affected_if":["entra-id-login-disabled","fixed-version","local-auth-only"],"how_to_check":"- Check whether Entra ID login is enabled in the phpMyFAQ configuration (unknown where the setting lives in the sources)\n- Check the installed version with `composer show phpmyfaq/phpmyfaq` or the version shown in the admin panel; affected ranges are 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta","fix":"- Upgrade phpMyFAQ to `4.2.0-beta` or later (the sources name 4.2.0-beta as the first fixed release for the 4.0.x line; unknown whether a stable 4.x release is fixed)\n- Until upgraded, disable the Microsoft Entra ID login integration\n- Review admin and super-admin accounts for unexpected logins or changed details","status":"open","published_at":"2026-10-17T19:16:31+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","triaged_at":"2026-10-25T03:14:38+00:00","updated_at":"2026-10-25T03:14:38+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T03:14:38Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade phpMyFAQ to `4.2.0-beta` or later (the sources name 4.2.0-beta as the first fixed release for the 4.0.x line; unknown whether a stable 4.x release is fixed)\n- Until upgraded, disable the Microsoft Entra ID login integration\n- Review admin and super-admin accounts for unexpected logins or changed details","reach":"internet","title":"phpMyFAQ: Entra ID login lets attacker take over local accounts","impact":"high","summary":"phpMyFAQ's Microsoft Entra ID login links users by the mutable preferred_username claim, and it keeps going with an existing local account when a duplicate login is detected. An attacker with an Entra identity in the configured tenant and a matching preferred_username can log in as that local account, including super-admin accounts.","category":"package","nicknames":[],"who_cares":["phpmyfaq","php","microsoft-entra-id","sso"],"confidence":0.7,"needs_auth":"yes","worst_case":"Attacker logs in as any matching local account, including super-admins.","analyst_note":"Confirm the fixed version (sources mention 4.2.0-beta; check whether a stable 4.x release is patched) and the exact config setting that enables Entra ID login.","how_to_check":"- Check whether Entra ID login is enabled in the phpMyFAQ configuration (unknown where the setting lives in the sources)\n- Check the installed version with `composer show phpmyfaq/phpmyfaq` or the version shown in the admin panel; affected ranges are 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta","needs_analyst":true,"not_affected_if":["entra-id-login-disabled","local-auth-only","fixed-version"],"who_is_affected":"Only installations that run phpMyFAQ with the Microsoft Entra ID login enabled and in the affected version ranges are exposed. The attack needs an identity inside the same Entra tenant the site trusts, so sites that use local logins only, or that trust no Entra tenant, can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000717,"input_tokens":3404,"output_tokens":754,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-111895':13A,16A '-2026':12A,15A '3.2.0':82C '4.0.0':84C '4.0.2':86C '4.2.0':88C 'account':10A,47B,75B,80B,126C,146C,151C 'admin':79B,150C 'attack':6A,55B,127C 'authent':92C 'authentraid':112C 'beta':89C 'bypass':93C 'claim':38B,109C 'configur':62B,134C 'contain':90C 'continu':121C 'control':128C 'creat':113C 'cve':11A,14A 'detect':53B 'duplic':50B,117C 'duplicate-login':116C 'entra':2A,19B,28B,58B,97C,130C 'except':119C 'exist':45B,124C 'flow':100C 'go':42B 'id':3A,20B,29B,98C 'ident':59B,131C 'ignor':114C 'includ':76B,147C 'keep':41B 'let':5A 'link':31B,102C 'local':9A,46B,74B,125C,145C 'log':70B 'login':4A,30B,51B,99C,118C 'match':66B,138C 'microsoft':18B,27B,96C 'microsoft-entra-id':17B 'mutabl':35B,106C 'packag':21B 'php':22B 'phpmyfaq':1A,23B,25B,81C 'prefer':36B,67B,107C,139C 'sso':24B 'super':78B,149C 'super-admin':77B,148C 'take':7A,142C 'tenant':63B,135C 'user':32B,103C 'usernam':37B,68B,108C,140C 'whose':111C","nicknames":[],"mitigations":[],"who_affected":"Only installations that run phpMyFAQ with the Microsoft Entra ID login enabled and in the affected version ranges are exposed. The attack needs an identity inside the same Entra tenant the site trusts, so sites that use local logins only, or that trust no Entra tenant, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-17T19:16:31+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-111895","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111895","severity":null,"published_at":"2026-10-17T19:16:31+00:00","modified_at":"2026-10-19T15:16:55+00:00","first_seen_at":"2026-10-23T21:57:14+00:00","fetched_at":"2026-10-23T22:28:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}