thorsten/phpmyfaq: Keycloak implicit account linking allows takeover of existing local accounts

Summary

An unlinked Keycloak identity can be mapped to an existing phpMyFAQ account by matching preferred_username or email. The external subject is then bound and authenticated as that local user, potentially a superadmin.

This also occurs when keycloak.autoProvision is disabled.

Details

KeycloakAuthenticationController::resolveLocalLogin() first checks keycloak_sub, but falls back to an existing local username or email. The callback authenticates that account and stores the attacker's Keycloak subject when the local binding is empty.

No proof exists that the local user authorized this account link. The email fallback also does not require an email_verified claim.

PoC

1. Install phpMyFAQ 4.2.0-beta.
2. Enable Keycloak and set keycloak.autoProvision=false.
3. Keep an existing local superadmin named admin with an empty keycloak_sub.
4. Create or control a Keycloak user whose preferred_username is admin.
5. Log in through /auth/keycloak/authorize.
6. Observe that the session is authenticated as the local superadmin.
7. Observe that the local account is now bound to the attacker's Keycloak subject.

Impact

A low-privileged Keycloak user who can obtain a colliding username or email can take over an existing local account and inherit all of its privileges, including full administrative access.