Overview
phpMyFAQ, the open-source FAQ and knowledge-base platform, has disclosed CVE-2026-111882, a high-severity authentication bypass (CWE-287, CVSS 3.1: 8.1) in its single sign-on integration. Users who authenticate through an organization's Keycloak or Microsoft Entra ID identity provider can skip the application's TOTP (time-based one-time password) second factor entirely by riding through the SSO callback handler — meaning any account tied to a valid or phished IdP identity gets a fully authenticated phpMyFAQ session without ever presenting a 2FA code.
The flaw affects phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta. It is fixed in 4.1.9 and 4.2.0-beta.
Vulnerability Details
| Attribute | Value |
|---|---|
| CVE ID | CVE-2026-111882 |
| CVSS Score | 8.1 (High, CVSS 3.1) |
| CWE | CWE-287: Improper Authentication |
| Attack Type | TOTP 2FA bypass via SSO callback handling |
| Authentication Required | Yes — a valid or phished IdP identity |
| User Interaction | Required |
| Affected Versions | 3.2.0-alpha ≤ 4.1.8; 4.2.0-alpha (pre-beta) |
| Patched Versions | 4.1.9, 4.2.0-beta |
| Disclosure Date | October 17, 2026 |
| Advisories | GHSA-43g3-pp5p-fg96, GHSA-8fvf-747v-qjr6 |
How the Attack Works
phpMyFAQ supports federated login through Keycloak and Microsoft Entra ID, layering its own TOTP-based second factor on top of the IdP's authentication. The callback handler that processes the IdP's response after a successful SSO login does not re-check whether the target account also has TOTP enforcement pending — so a session that completes the Keycloak or Entra ID handshake is treated as fully authenticated, with the TOTP challenge silently skipped.
1. Attacker holds (or phishes) credentials for an IdP identity linked to
a phpMyFAQ account that has TOTP 2FA enabled
2. Attacker completes the Keycloak or Entra ID login flow normally
3. phpMyFAQ's SSO callback accepts the IdP assertion and establishes
a session — without routing the user through the TOTP challenge
4. Attacker now holds a fully authenticated phpMyFAQ session,
bypassing the second factor the account owner relied onBecause the weakness sits in the callback handler shared by both SSO providers, it applies uniformly whether an organization federates through Keycloak or Entra ID — the TOTP requirement provides no additional protection for SSO-linked accounts on vulnerable versions.
Related disclosures in the same batch
Two related phpMyFAQ SSO flaws were disclosed alongside CVE-2026-111882, all affecting federated-login handling:
| CVE | CVSS | Issue |
|---|---|---|
| CVE-2026-111882 | 8.1 High | TOTP 2FA skipped via Keycloak/Entra ID callback |
| CVE-2026-111895 | 6.8 Medium | Entra ID account takeover via mutable preferred_username claim |
| EUVD-2026-103321 | 7.5 High | Keycloak account takeover via preferred_username/email matching |
The cluster points to a broader review of phpMyFAQ's IdP integration code; organizations using either SSO provider should patch for all three, not just CVE-2026-111882.
Remediation
Upgrade
Update to phpMyFAQ 4.1.9 or 4.2.0-beta, both of which correct the callback handler to enforce pending TOTP challenges regardless of SSO authentication path.
Interim Controls
If an immediate upgrade isn't possible:
- Audit SSO-linked accounts — identify which local accounts have TOTP enabled and are also linked to Keycloak or Entra ID federation
- Review authentication logs — look for SSO logins to TOTP-protected accounts that show no corresponding TOTP challenge event
- Tighten IdP-side MFA — since the bypass trusts the IdP assertion, strong MFA enforced at the Keycloak/Entra ID layer reduces exposure until phpMyFAQ is patched
- Restrict SSO callback exposure — where feasible, limit which networks can reach the SSO callback endpoint