Authentication Bypass in phpMyFAQ via Keycloak Identity Collision

Executive Summary

This vulnerability is an authentication bypass in phpMyFAQ versions 4.2.0-alpha through 4.2.0-beta that allows Keycloak users to take over local accounts. Attackers can exploit it by matching a Keycloak identity's preferred_username or email to an existing local account, even without email verification. This grants superadmin privileges through the /auth/keycloak/authorize endpoint.

Useful 0 Not Useful 0

Detection Guidance

Check phpMyFAQ logs for repeated login attempts via /auth/keycloak/authorize with matching preferred_username or email fields. Inspect Keycloak authentication events for unlinked identities binding to local accounts. Review user accounts for unexpected privilege escalations to superadmin.

Useful 0 Not Useful 0

Impact Analysis

If you use phpMyFAQ with Keycloak authentication in the affected versions, attackers could gain full administrative access to your system. This includes taking over superadmin accounts, potentially leading to data breaches, unauthorized modifications, or complete system compromise.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection requirements and HIPAA's security rules. It may result in data breaches, unauthorized disclosures, or loss of audit controls, potentially leading to regulatory penalties and compliance failures.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade phpMyFAQ to version 4.2.0-beta or later immediately. Disable Keycloak implicit account linking in phpMyFAQ configuration. Audit all user accounts for unauthorized privilege changes. Monitor for suspicious login patterns via /auth/keycloak/authorize.

Useful 0 Not Useful 0