CVE-2026-111882 is a high severity (CVSS 8.1) authentication bypass in phpMyFAQ. SSO logins through Keycloak or Microsoft Entra ID skip TOTP two-factor checks. The record lists fixes in 4.1.9 and 4.2.0-beta, but the GitHub advisory lists none, so verify before you rely on either.
What's affected
Per the record: phpMyFAQ 3.2.0-alpha before 4.1.9, and 4.2.0-alpha before 4.2.0-beta. The GitHub advisories I fetched give affected versions as up to 4.2.0-alpha.2 and say patched versions are none.
Source conflict: the record says the fix is in 4.1.9 or 4.2.0-beta, while the GitHub advisory page I fetched lists patched versions as none. Check the phpMyFAQ release notes and the advisory before relying on either.
Only installs that use Keycloak or Entra ID sign in are affected.
Scoring note: the record's 8.1 is a CVSS 3.1 base score. VulnCheck's advisory also lists 8.6 under CVSS 4.0. Both describe the same flaw, and the two versions weigh the factors differently.
How to check if you're exposed
Check the phpMyFAQ version in the admin area or through Composer:
composer show phpmyfaq/phpmyfaq
Then check whether Keycloak or Entra ID login is enabled in your configuration, and which accounts have TOTP turned on. Those accounts are the ones whose second factor is being skipped.
What to do now
- Find your phpMyFAQ version and whether SSO is enabled.
- Confirm in the phpMyFAQ advisories and release notes which version fixes this for you.
- Upgrade to 4.1.9 or 4.2.0-beta if your check confirms they contain the fix.
- Until then, require two-factor at the identity provider, so a valid IdP login already proves a second factor.
- Review administrator sign ins for unexpected sessions.
- Scan your dependencies with the free in-browser scan and look the CVE up in the Gold directory to see where else it appears.
Prioritise by what is reachable, not by the score alone. Reachability analysis asks whether your own code actually calls the vulnerable path and whether an attacker can get to it. A flaw in a component you never expose is less urgent than the same flaw on a public host, so use that view to order your work.
Why it matters
This is CWE-287, improper authentication. After the identity provider confirms the user, the callback code marks the session as fully logged in without reading whether the linked account requires TOTP. The second factor is skipped entirely on this path.
The advisory notes administrators are included, and they are the accounts where two-factor is usually required by policy. The advisory also says an earlier fix covered only the password check path, which is a common way for authentication rules to leak: one rule enforced at one entry point. It is not listed in CISA KEV.
Quick check
Is the identity provider's own MFA enough?
If your IdP enforces a second factor for every login, that protects you while phpMyFAQ skips its own check.
Why do sources disagree?
The record lists fixed versions while the GitHub advisory says none. Check release notes directly.
Sources
- VulnCheck advisory
- phpMyFAQ advisory GHSA-43g3-pp5p-fg96
- phpMyFAQ advisory GHSA-8fvf-747v-qjr6
- Gold entry for CVE-2026-111882
Last reviewed: 18 October 2026.
