CVE-2026-111895: phpMyFAQ authentication bypass in Microsoft Entra ID login

CVE-2026-111895 · Severity: medium · CVSS 6.8 · Published 2026-10-17

phpMyFAQ is a knowledge base and FAQ management system that supports Microsoft Entra ID (Azure) single sign-on for user authentication. An attacker who controls an Entra identity with a username matching an existing phpMyFAQ account can hijack that local account, including administrator accounts, by exploiting a flaw in how the system links user identities. The attack requires the attacker to have access to a Microsoft Entra tenant configured for the target phpMyFAQ instance.

Technologies: Phpmyfaq. Vendors: Phpmyfaq.

Quick answers

Is CVE-2026-111895 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-111895 being exploited in the wild.
How severe is CVE-2026-111895?
Medium severity, with a CVSS score of 6.8, published 17 October 2026.
Which products and versions are affected?
Phpmyfaq 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta.
Is there a fix for CVE-2026-111895?
Yes: fixed in 4.2.0-beta. Until then: Disable Microsoft Entra ID authentication until the system can be updated to a patched version. Alternatively, restrict access to the Azure authentication callback endpoint and ensure strict identity verification is enforced through Entra tenant policies.</anigation> <parameter name="timeline">[ { "kind": "disclosed", "at": "2026-10-03", "note": "GitHub security advisory GHSA-6hhv-gc4g-f4r7 published" }, { "kind": "advisory", "at": "2026-10-17", "note": "CVE-2026-111895 published on NVD" } ] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-111895 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-111895?
Check whether you run Phpmyfaq at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: 4.2.0-beta

Disable Microsoft Entra ID authentication until the system can be updated to a patched version. Alternatively, restrict access to the Azure authentication callback endpoint and ensure strict identity verification is enforced through Entra tenant policies.</anigation> <parameter name="timeline">[ { "kind": "disclosed", "at": "2026-10-03", "note": "GitHub security advisory GHSA-6hhv-gc4g-f4r7 published" }, { "kind": "advisory", "at": "2026-10-17", "note": "CVE-2026-111895 published on NVD" } ]

Technical details

The vulnerability exists in the Entra ID authentication flow where user linking is based on the mutable preferred_username claim rather than an immutable identifier like oid or sub. When an Entra-authenticated user's preferred_username matches an existing local account, the AuthEntraId::create() method catches and ignores the duplicate login exception while continuing to operate on the pre-existing user object, then activates the account, changes its authentication source to Azure, and overwrites the email. An attacker controlling an Entra identity in the configured tenant whose preferred_username collides with a target phpMyFAQ username can take over that account with no further authentication required.

Affected products

  • phpMyFAQ phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.