CVE-2026-46359 Details

A SQL injection vulnerability has been identified in phpMyFAQ versions prior to 4.1.2. The issue arises in the CurrentUser::setTokenData method, where OAuth token claims are injected into a SQL UPDATE statement without proper escaping. This flaw allows authenticated attackers to execute arbitrary SQL commands. The vulnerability is particularly exploitable for attackers with Azure AD accounts that include SQL metacharacters in their display names or JWT claims, enabling them to manipulate SQL string literals and execute custom database queries.

Update phpMyFAQ to version 4.1.2 or later, and ensure that all interpolated values in the setTokenData method are properly escaped using the database escape function.