CVE-2026-111882GHSA-43g3-pp5p-fg96GHSA-8fvf-747v-qjr6
phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta TOTP 2FA Bypass via SSO Callbacks
thorsten phpMyFAQ
CVSS
8.6HighExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.39%Chance of exploitation activity in the next 30 days, higher than 31% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows IdP-authenticated users to skip TOTP two-factor authentication through the Keycloak and Entra ID SSO callbacks. Attackers holding a valid or phished IdP identity linked to a 2FA-enabled account can complete the OIDC flow and obtain a fully authenticated session, including administrator accounts.
Text from CVE List
Affected versions 4
- phpMyFAQaffected: 3.2.0-alpha before 4.1.9CVE List
- phpMyFAQunaffected: 4.1.9CVE List
- phpMyFAQaffected: 4.2.0-alpha before 4.2.0-betaCVE List
- phpMyFAQunaffected: 4.2.0-betaCVE List
References 3
- github.com/thorsten/phpMyFAQ/security/advisories/GHSA-43g3-pp5p-fg96Advisoryvia CVE List
- github.com/thorsten/phpMyFAQ/security/advisories/GHSA-8fvf-747v-qjr6Advisoryvia CVE List
- vulncheck.com/advisories/phpmyfaq-3.2.0-alpha-before-4.1.9-and-4.2.0-alpha-before-4.2.0-beta-totp-2fa-bypass-via-sso-callbacksAdvisoryvia CVE List