CVE-2026-111895: Improper Authentication in thorsten phpMyFAQ

The vulnerability in phpMyFAQ affects versions >=3.2.0 <4.0.0 and >=4.0.2 <4.2.0-beta. It arises from an authentication bypass in the Microsoft Entra ID login mechanism, where the system links users based on the mutable preferred_username claim. The AuthEntraId::create() function ignores duplicate-login exceptions and proceeds with the existing local account, enabling attackers controlling an Entra identity in the configured tenant with a matching preferred_username to take over that local account, including those with super-admin privileges.

An attacker who controls a Microsoft Entra identity with a preferred_username matching a local phpMyFAQ account can bypass authentication controls and assume that account's privileges. This includes the potential takeover of super-admin accounts, leading to full administrative control over the affected phpMyFAQ instance.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the Microsoft Entra ID login feature or monitor for suspicious login activity involving preferred_username claims. Avoid relying solely on the preferred_username claim for authentication linkage.