CVE-2026-111898 phpMyFAQ CVE debrief

Who should care

Defenders responsible for phpMyFAQ instances with Keycloak authentication should assess exposure and verify the feasibility of account takeovers. Defenders should prioritize verifying exposure of phpMyFAQ instances to Keycloak authentication and assess the feasibility of account takeovers. This vulnerability affects operators of phpMyFAQ instances with Keycloak authentication, platform administrators, vulnerability management teams, and security teams.

Why it matters

CVE-2026-111898 is an authentication bypass vulnerability in phpMyFAQ 4.2.0-alpha before 4.2.0-beta that allows Keycloak users to take over local accounts. Defenders should prioritize verifying exposure of phpMyFAQ instances to Keycloak authentication and assess the feasibility of account takeovers.

• Potential for superadmin privilege escalation through /auth/keycloak/authorize
• Risk of unauthorized access to phpMyFAQ instances through Keycloak authentication

Technical summary

The vulnerability allows Keycloak users to take over local accounts in phpMyFAQ 4.2.0-alpha before 4.2.0-beta by matching preferred_username or email. Attackers controlling a Keycloak identity with a colliding username or unverified email can log in through /auth/keycloak/authorize to bind their subject and gain superadmin privileges. Defenders should prioritize verifying exposure of phpMyFAQ instances to Keycloak authentication and assess the feasibility of account takeovers. The vulnerability is an authentication bypass vulnerability in phpMyFAQ 4.2.0-alpha before 4.2.0-beta.

Defensive priority

Defenders should prioritize verifying exposure of phpMyFAQ instances to Keycloak authentication and assess the feasibility of account takeovers.

Recommended defensive actions

• Verify phpMyFAQ instances are not exposed to unauthorized Keycloak authentication
• Assess the feasibility of account takeovers through /auth/keycloak/authorize
• Implement compensating controls to prevent superadmin privilege escalation
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the authentication bypass vulnerability in phpMyFAQ 4.2.0-alpha before 4.2.0-beta. The vulnerability allows Keycloak users to take over local accounts by matching preferred_username or email. Defenders should verify the feasibility of account takeovers and assess exposure of phpMyFAQ instances to Keycloak authentication. The CVE Program record and NVD entry provide source-provided CVE metadata and official vulnerability assessment.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.