CVE-2026-111882

The phpMyFAQ application versions 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta are vulnerable to an authentication bypass (CWE-287). The root cause lies in the Keycloak and Entra ID SSO callbacks, which allow IdP-authenticated users to skip TOTP two-factor authentication . An attack...

EUVD-2026-103336

phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows IdP-authenticated users to skip TOTP two-factor authentication through the Keycloak and Entra ID SSO callbacks. Attackers holding a valid or phished IdP identity linked ...