CVE-2026-111898: phpMyFAQ 4.2.0-alpha before 4.2.0-beta Account Takeover via Keycloak Implicit Account Linking
phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows Keycloak users to take over local accounts by matching preferredusername or email. Attackers controlling a Keycloak identity with a colliding username or unverified email can log in through /auth/keycloak/authorize to bind their subject and gain superadmin privileges.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
phpMyFAQ installations running 4.2.0-alpha before 4.2.0-beta that use Keycloak authentication are exposed through the /auth/keycloak/authorize flow.
What does an attacker need to exploit this?
The attacker needs control of a Keycloak identity whose preferred_username collides with a local account username, or whose email matches a local account email without being verified.
What is the resulting access level?
Successful exploitation binds the attacker's Keycloak subject to the matching local account and can grant superadmin privileges.