phpMyFAQ: Authentication bypass skips TOTP 2FA in SSO login
Summary
phpMyFAQ versions 3.2.0-alpha to before 4.1.9 and 4.2.0-alpha to before 4.2.0-beta allow users who sign in through Keycloak or Microsoft Entra ID SSO to skip TOTP two-factor authentication. An attacker holding a valid or phished IdP identity linked to a 2FA-enabled account, including an administrator account, can obtain a fully authenticated session. The flaw only applies where Keycloak or Entra ID SSO is configured.
Affected
- phpMyFAQ 3.2.0-alpha to before 4.1.9 (CNA record)
- phpMyFAQ 4.2.0-alpha to before 4.2.0-beta (CNA record)
- Vendor advisories cover 4.2.0-alpha up to 4.2.0-alpha.2 and the 4.1.x nightly builds from 2026-04-20; the affected SSO callbacks are absent from releases 4.1.5 to 4.1.8
Fixed in
- 4.1.9 and 4.2.0-beta (per CNA record)
- The vendor advisories state that no fixed version was known at the time of writing; confirm the fixed version with the vendor before relying on it
Workaround
- Unknown. No vendor workaround is published.
- Until a fixed version is confirmed, disable Keycloak and Entra ID SSO login, or at least for administrator accounts.
Exploitation
- No known exploitation in the wild. Listing in the CISA KEV catalogue is not confirmed.
- CISA SSVC assessment: exploitation none, not automatable, total technical impact.
- The vendor advisory describes a lab verification; no public exploit code was found.
Our recommendation
- Check whether Keycloak or Entra ID SSO is configured and whether 2FA-enabled accounts are linked to it.
- Upgrade to 4.1.9 or 4.2.0-beta or later, and confirm the fix against the vendor advisory.
- Review administrator accounts and SSO login logs since 2026-10-17 for unexpected logins, and end active sessions after the upgrade.
- Restrict access to the admin interface by IP address or VPN where feasible, and monitor for SSO logins that do not involve a token step.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Advisory GHSA-43g3-pp5p-fg96 github.com
- GitHub Advisory GHSA-8fvf-747v-qjr6 github.com
- VulnCheck advisory www.vulncheck.com
- VulDB CVE-2026-111882 vuldb.com
- Vulners CVE-2026-111882 vulners.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 07:50.
Original description (NVD)
phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows IdP-authenticated users to skip TOTP two-factor authentication through the Keycloak and Entra ID SSO callbacks. Attackers holding a valid or phished IdP identity linked to a 2FA-enabled account can complete the OIDC flow and obtain a fully authenticated session, including administrator accounts.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.