CVE-2026-111882: Improper Authentication in thorsten phpMyFAQ

CVE-2026-111882 describes an authentication bypass vulnerability in phpMyFAQ affecting versions >=3.2.0-alpha <4.1.9 and >=4.2.0-alpha <4.2.0-beta. The vulnerability arises in the handling of Keycloak and Entra ID SSO callbacks, where IdP-authenticated users can skip the TOTP two-factor authentication step. This allows attackers who possess a valid or phished IdP identity linked to an account with 2FA enabled to bypass the second factor and obtain full authenticated sessions, including those of administrators. The CVSS 4.0 score is 8.6, indicating high severity with network attack vector, low attack complexity, no privileges required, user interaction required, and high impact on confidentiality and integrity.

Successful exploitation allows attackers to bypass TOTP two-factor authentication in phpMyFAQ, gaining full authenticated sessions. This includes administrative accounts, potentially leading to unauthorized access, data exposure, and administrative control over the phpMyFAQ installation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the affected phpMyFAQ versions and monitor for suspicious IdP authentication activities. Avoid using vulnerable versions in production environments.