# phpMyFAQ SQL injection in CurrentUser::setTokenData

Source: https://junglewise.ai/threats/phpmyfaq-sql-injection-in-currentuser-settokendata-3dcbb4d3  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-15. Updated: 2026-06-09  
License: CC BY 4.0 with a link back

Severity: high · CVSS 7.5 · Published 2026-05-15

phpMyFAQ is an open-source FAQ software platform. A vulnerability in its authentication system allows an attacker to execute unauthorized database commands by using a specially crafted account name or profile information during the login process. This could lead to the theft of sensitive user data, modification of FAQ content, or full administrative takeover of the platform.

Technologies: [phpmyfaq/phpmyfaq (Packagist)](https://junglewise.ai/threats/technologies/phpmyfaq-phpmyfaq), [thorsten/phpmyfaq (Packagist)](https://junglewise.ai/threats/technologies/thorsten-phpmyfaq), [Thorsten phpMyFAQ](https://junglewise.ai/threats/technologies/phpmyfaq). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist), [Thorsten](https://junglewise.ai/threats/vendors/thorsten).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** High severity, with a CVSS score of 7.5, published 15 May 2026.

**Which products and versions are affected?** phpmyfaq/phpmyfaq (Packagist) < 4.1.2; thorsten/phpmyfaq (Packagist) < 4.1.2; Thorsten phpMyFAQ < 4.1.2.

**Is there a fix for This vulnerability?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is This vulnerability attacked?** It is attacked over the network, in a network appliance.

**Am I affected?** Check whether you run phpmyfaq/phpmyfaq (Packagist), thorsten/phpmyfaq (Packagist) or Thorsten phpMyFAQ at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A SQL injection vulnerability exists in phpMyFAQ's CurrentUser::setTokenData() method within src/phpMyFAQ/User/CurrentUser.php. The application uses sprintf() to build an UPDATE statement using OAuth token fields (refresh_token, access_token, code_verifier, and JWT claims) without proper escaping via the database driver. While json_encode() is used on JWT data, it does not escape single quotes, allowing an attacker to break out of the SQL string literal. An attacker can exploit this by registering an account with a malicious display name or JWT claim (e.g., through Azure AD/Entra ID) that contains SQL metacharacters. Successful exploitation allows for arbitrary database read/write access. The issue is fixed in version 4.1.2 by implementing proper escaping for all interpolated values.

## Affected products

- thorsten phpMyFAQ < 4.1.2

## Timeline

- 2026-04-28: advisory: Original advisory GHSA-pm8c-3qq3-72w7 published
- 2026-05-15: disclosed: CVE-2026-46359 assigned and published to NVD
- 2026-06-09: other: Duplicate advisory GHSA-p9wc-4pjv-rg82 withdrawn

## References

- [https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-pm8c-3qq3-72w7](https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-pm8c-3qq3-72w7)
- [https://www.vulncheck.com/advisories/phpmyfaq-sql-injection-in-currentuser-settokendata-via-unescaped-oauth-token-fields](https://www.vulncheck.com/advisories/phpmyfaq-sql-injection-in-currentuser-settokendata-via-unescaped-oauth-token-fields)

## Related threats

- [phpMyFAQ insufficient authorization in group deletion](https://junglewise.ai/threats/cve-2026-124433-phpmyfaq-before-4-1-11-contains-an-insufficient-authorization)
- [phpMyFAQ WebAuthn account enumeration in prepare-login](https://junglewise.ai/threats/cve-2026-124432-phpmyfaq-4-1-9-before-4-1-11-and-4-2-0-pre-releases-before-4-2-0)
- [phpMyFAQ authorization bypass in attachment downloads](https://junglewise.ai/threats/cve-2026-111910-phpmyfaq-before-4-1-9-and-4-2-0-alpha-before-4-2-0-beta-contains)
- [phpMyFAQ missing authorization in deleteUser API](https://junglewise.ai/threats/cve-2026-111909-phpmyfaq-before-4-1-9-contains-a-missing-authorization)
- [phpMyFAQ broken object-level authorization in FAQ update API](https://junglewise.ai/threats/cve-2026-111908-phpmyfaq-4-0-0-before-4-1-9-and-4-2-0-alpha-before-4-2-0-beta)