High priorityDisclosed

Advisory · CVE-2026-111882

phpMyFAQ SSO callbacks can skip TOTP two-factor authentication

phpMyFAQ from 3.2.0-alpha before 4.1.9, and 4.2.0-alpha before 4.2.0-beta, allows IdP-authenticated users to skip TOTP two-factor authentication through the Keycloak and Entra ID SSO callbacks, including on administrator accounts. CVSS 3.1 8.1.

Advisory published October 17, 2026Independent summary
Vendor
phpMyFAQ
Product
phpMyFAQ
Identifier / CWE
CVE-2026-111882
CWE-287
Action timing
Immediate
ELI5

Explain it like I’m five

Logging in through the office SSO door skips the second-factor check entirely, so a phished work identity becomes a full phpMyFAQ login.

SIMPLIFIED_ATTACK_PATH03 STEPS
  1. 01IdP identity held

    An attacker holds a valid or phished identity provider account linked to a 2FA-enabled phpMyFAQ account.

  2. 02SSO callback completes

    The attacker completes the OIDC flow through the Keycloak or Entra ID callback.

  3. 03TOTP skipped

    phpMyFAQ issues a fully authenticated session without the TOTP step, including for administrator accounts.

What happened

The phpMyFAQ project disclosed CVE-2026-111882: an authentication bypass (CWE-287) that allows IdP-authenticated users to skip TOTP two-factor authentication through the Keycloak and Entra ID SSO callbacks. It affects the lines from 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta.

Per the vendor affected data in the NVD record, 4.1.9 and 4.2.0-beta are the first unaffected releases for their respective lines.

What to do

  1. Inventory phpMyFAQ instances, including staging, demo, and help-desk installs.
  2. Upgrade affected instances to 4.1.9 or later (or 4.2.0-beta or later on the 4.2 line) using the project release guidance.
  3. Restrict administrative and API access to trusted networks while remediation is underway.
  4. Hunt for SSO logins to 2FA-enabled accounts that have no matching TOTP event, especially administrator sign-ins via Keycloak or Entra ID.
  5. Verify the deployed version after updating, not just that an update ran.

Management note

Two-factor authentication that one login path can skip is a policy statement, not a control. Upgrade, then audit SSO sessions on privileged accounts back to your log retention limit.