CVE-2026-111895

phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta contains an authentication bypass in its Microsoft Entra ID login flow, which links users by the mutable preferredusername claim and whose AuthEntraId::create ignores the duplicate-login exception while continuing with the existing local...

CVE-2026-111895 phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta Account Takeover via Entra ID preferred_username

phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta contains an authentication bypass in its Microsoft Entra ID login flow, which links users by the mutable preferredusername claim and whose AuthEntraId::create ignores the duplicate-login exception while continuing with the existing local...

CVE-2026-111895 phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta Account Takeover via Entra ID preferred_username

phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta contains an authentication bypass in its Microsoft Entra ID login flow, which links users by the mutable preferredusername claim and whose AuthEntraId::create ignores the duplicate-login exception while continuing with the existing local...

CVE-2026-111895

The phpMyFAQ application (versions 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta ) contains an authentication bypass in the Microsoft Entra ID login flow. The root cause is located in the AuthEntraId::create() function, which improperly links users using the mutable preferred_username claim and ...

CVE-2026-111895

phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta contains an authentication bypass in its Microsoft Entra ID login flow, which links users by the mutable preferredusername claim and whose AuthEntraId::create ignores the duplicate-login exception while continuing with the existing local...

EUVD-2026-103324

phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta contains an authentication bypass in its Microsoft Entra ID login flow, which links users by the mutable preferredusername claim and whose AuthEntraId::create ignores the duplicate-login exception while continuing with the existing local...

CVE-2026-111895 phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta Account Takeover via Entra ID preferred_username

phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta contains an authentication bypass in its Microsoft Entra ID login flow, which links users by the mutable preferredusername claim and whose AuthEntraId::create ignores the duplicate-login exception while continuing with the existing local...

CVE-2026-111895: Improper Authentication

phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta contains an authentication bypass in its Microsoft Entra ID login flow, which links users by the mutable preferredusername claim and whose AuthEntraId::create ignores the duplicate-login exception while continuing with the existing local...

Thorsten Rinne phpMyFAQ Authorization Issues Vulnerability

Thorsten Rinne reported an authorization issue in versions of phpMyFAQ from 3.2.0 to 4.0.0, and from 4.0.2 to 4.2.0-beta. The issue stems from a bypass in the Microsoft Entra ID login process. By associating users through a variable preferredusername, and because the function AuthEntraId::create...

CVE-2026-104108

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise maps an authenticated OIDC identity to a local account using mutable preferredusername or email claims and does not require emailverified for email-based naming. An...

CVE-2026-104108 FileRise OIDC login can bind an attacker identity to an existing local account

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise maps an authenticated OIDC identity to a local account using mutable preferredusername or email claims and does not require emailverified for email-based naming. An...

EUVD-2026-101686

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise maps an authenticated OIDC identity to a local account using mutable preferredusername or email claims and does not require emailverified for email-based naming. An...

CVE-2026-104108 FileRise OIDC login can bind an attacker identity to an existing local account

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise maps an authenticated OIDC identity to a local account using mutable preferredusername or email claims and does not require emailverified for email-based naming. An...

CVE-2026-104108: Improper Authentication

FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.23.0, FileRise maps an authenticated OIDC identity to a local account using mutable preferredusername or email claims and does not require emailverified for email-based naming. An...

Improper Authentication

allauth-django is vulnerable to improper authentication. The vulnerability is due to the use of the mutable preferredusername attribute as the identifier for third-party provider accounts, which allows an attacker to change this value and potentially impersonate or gain unauthorized access to...

django-allauth's Okta and NetIQ implementations used a mutable identifier for authorization decisions

An issue was discovered in allauth-django before 65.13.0. Both Okta and NetIQ were using preferredusername as the identifier for third-party provider accounts. That value may be mutable and should therefore be avoided for authorization decisions. The providers are now using sub instead...

EUVD-2025-203376

An issue was discovered in allauth-django before 65.13.0. Both Okta and NetIQ were using preferredusername as the identifier for third-party provider accounts. That value may be mutable and should therefore be avoided for authorization decisions. The providers are now using sub instead...

Improper Certificate Validation

Overview django-allauth is an integrated set of Django applications addressing authentication, registration, account management as well as 3rd party social account authentication. Affected versions of this package are vulnerable to Improper Certificate Validation via the preferredusername field...

PYSEC-2025-111

An issue was discovered in allauth-django before 65.13.0. Both Okta and NetIQ were using preferredusername as the identifier for third-party provider accounts. That value may be mutable and should therefore be avoided for authorization decisions. The providers are now using sub instead...

CVE-2025-65431

An issue was discovered in allauth-django before 65.13.0. Both Okta and NetIQ were using preferredusername as the identifier for third-party provider accounts. That value may be mutable and should therefore be avoided for authorization decisions. The providers are now using sub instead...