CVE-2026-111882: phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta TOTP 2FA Bypass via SSO Callbacks
phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows IdP-authenticated users to skip TOTP two-factor authentication through the Keycloak and Entra ID SSO callbacks. Attackers holding a valid or phished IdP identity linked to a 2FA-enabled account can complete the OIDC flow and obtain a fully authenticated session, including administrator accounts.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
phpMyFAQto a version that resolves this vulnerability.Fixed in 4.1.9 - Upgrade
Upgrade
phpMyFAQto a version that resolves this vulnerability.Fixed in 4.2.0-beta
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs a valid or phished identity from the configured identity provider that is linked to a phpMyFAQ account with TOTP 2FA enabled. The affected SSO paths are the Keycloak and Entra ID callbacks, and administrator accounts are included.
Does exploitation require access to the phpMyFAQ account's TOTP code?
No. An attacker can complete the OIDC flow through the affected SSO callbacks and obtain a fully authenticated session without satisfying TOTP.
Which releases are affected?
Affected versions are phpMyFAQ 3.2.0-alpha before 4.1.9, and 4.2.0-alpha before 4.2.0-beta.