CVE-2026-111898

phpMyFAQ versions 4.2.0-alpha before 4.2.0-beta are vulnerable to an authentication bypass due to implicit account linking with Keycloak . An attacker controlling a Keycloak identity with a colliding preferred_username or an unverified email can exploit this flaw by logging in through the /auth/k...