CVE-2026-111895 Details
Description
phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta contains an authentication bypass in its Microsoft Entra ID login flow, which links users by the mutable preferred_username claim and whose AuthEntraId::create() ignores the duplicate-login exception while continuing with the existing local account. Attackers controlling an Entra identity in the configured tenant with a matching preferred_username can take over that local account, including super-admin accounts.
An authentication bypass vulnerability has been identified in phpMyFAQ versions 3.2.0 prior to 4.0.0 and 4.0.2 prior to 4.2.0-beta. The issue arises in the Microsoft Entra ID login process, where users are linked using the mutable 'preferred_username' claim. The 'AuthEntraId::create()' function fails to properly handle duplicate login exceptions, allowing attackers with control over an Entra identity in the configured tenant to take over local accounts, including those with super-admin privileges.
Users are advised to update phpMyFAQ to version 4.2.0-beta, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 17, 2026CISA-ADP
Assessed Oct 19, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-6hhv-gc4g-f4r7 | CISA-ADP | AdvisoryExploitTechnical AnalysisVendor |
| https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-6hhv-gc4g-f4r7 | [email protected] | AdvisoryExploitTechnical AnalysisVendor |
| https://www.vulncheck.com/advisories/phpmyfaq-3.2.0-before-4.0.0-and-4.0.2-before-4.2.0-beta-account-takeover-via-entra-id-preferred-username | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-287 | Improper Authentication | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| phpMyFAQ | <= 4.2.0-alpha.2 (semver) >= 4.0.2, < 4.2.0-beta (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 19, 2026 | CVE Modified | CISA-ADP |
| Oct 17, 2026 | New CVE Received | [email protected] |