CVE-2026-111895: phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta Account Takeover via Entra ID preferred_username
phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta contains an authentication bypass in its Microsoft Entra ID login flow, which links users by the mutable preferredusername claim and whose AuthEntraId::create() ignores the duplicate-login exception while continuing with the existing local account. Attackers controlling an Entra identity in the configured tenant with a matching preferredusername can take over that local account, including super-admin accounts.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
phpMyFAQto a version that resolves this vulnerability.Fixed in 4.0.0 - Upgrade
Upgrade
phpMyFAQto a version that resolves this vulnerability.Fixed in 4.2.0-beta
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker needs to control a Microsoft Entra ID identity in the tenant configured for the phpMyFAQ instance and set or obtain a preferred_username matching an existing local phpMyFAQ account. The impact includes takeover of super-admin accounts when their local login matches.
Are deployments using phpMyFAQ's default authentication affected?
The issue is in the Microsoft Entra ID login flow. The provided information does not indicate that deployments not using configured Entra ID authentication are affected.
What versions need remediation?
Affected versions are phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta. Updating to a version outside those stated ranges addresses the affected version ranges.
What can be done if an update cannot be applied immediately?
The provided information identifies the Entra ID login flow as the affected component. Restricting or disabling that login flow would remove the described path, particularly where local accounts share names that could match Entra preferred_username claims.