CVE-2026-111882
8.1HighPublished 17 Oct 2026 · NVD status: Deferred · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
- Impact
- High impact on confidentiality, integrity
- Weakness
- CWE-287
Impact
Attackers with valid or phished IdP credentials can bypass TOTP 2FA and hijack linked accounts, including administrators. They need control of an IdP identity linked to an existing account and network access to complete the SSO callback flow.
Root cause
The Keycloak and Entra ID SSO OIDC callback handlers complete user authentication without enforcing the required TOTP verification step.
Affected systems
phpMyFAQ 3.2.0-alpha before 4.1.9, and 4.2.0-alpha before 4.2.0-beta
CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N
Fix & remediation
Upgrade to phpMyFAQ 4.1.9, 4.2.0-beta, or later. If patching immediately is not possible, disable Keycloak and Entra ID SSO authentication in the phpMyFAQ configuration.
$ composer update phpmyfaq/phpmyfaqAI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows IdP-authenticated users to skip TOTP two-factor authentication through the Keycloak and Entra ID SSO callbacks. Attackers holding a valid or phished IdP identity linked to a 2FA-enabled account can complete the OIDC flow and obtain a fully authenticated session, including administrator accounts.