CVE-2026-111895
Deferred Deferred - Pending Action

Authentication Bypass in phpMyFAQ via Entra ID Preferred Username Claim

Publication date: 2026-10-17

Last updated on: 2026-10-17

Assigner: VulnCheck

Description
phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta contains an authentication bypass in its Microsoft Entra ID login flow, which links users by the mutable preferred_username claim and whose AuthEntraId::create() ignores the duplicate-login exception while continuing with the existing local account. Attackers controlling an Entra identity in the configured tenant with a matching preferred_username can take over that local account, including super-admin accounts.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-17
Last Modified
2026-10-17
Generated
2026-10-17
AI Q&A
2026-10-17
EPSS Evaluated
N/A
NVD
CVE-2026-111895
EUVD
EUVD-2026-103324

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
thorsten phpMyFAQ 3.2.0
thorsten phpMyFAQ 4.0.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an authentication bypass in phpMyFAQ's Microsoft Entra ID login flow. It occurs because the system links users based on the mutable preferred_username claim instead of an immutable identifier like oid or sub. Attackers controlling an Entra identity with a matching preferred_username can take over existing local accounts, including super-admin accounts, by exploiting improper exception handling that silently adopts existing accounts.

Detection Guidance

Check phpMyFAQ logs for unusual authentication events or duplicate preferred_username claims. Inspect user account modifications, especially for super-admin accounts. Review Entra ID login flows for mismatched identifiers.

Impact Analysis

This vulnerability allows attackers to take over your phpMyFAQ account, including administrative accounts, without needing your credentials. They can reactivate blocked accounts, modify authentication sources and email addresses, and make persistent changes to your account. Successful exploitation requires an attacker to control an Entra identity with a colliding preferred_username.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating confidentiality and integrity requirements under GDPR and HIPAA. Account takeover risks unauthorized disclosure of personal data, non-compliance with access controls, and potential breaches of data protection regulations.

Mitigation Strategies

Upgrade phpMyFAQ to a patched version. Configure Entra ID authentication to use immutable identifiers like oid or sub instead of preferred_username. Disable automatic account adoption on username collisions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-111895. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart