phpMyFAQ CVE-2026-111898

Exploitation requires that the phpMyFAQ instance be explicitly configured to use Keycloak as an SSO identity provider (the /auth/keycloak/authorize flow must be active) and that implicit account linking matches identities by preferred_username or email. The attacker must control a Keycloak identity whose preferred_username collides with, or whose unverified email matches, an existing local phpMyFAQ account - ideally a superadmin - so a pre-existing privileged local account is a prerequisite. Exploitation is strictly limited to versions 4.2.0-alpha up to (not including) 4.2.0-beta, which are pre-release builds, substantially reducing the realistic attack surface. Limiting factors: non-default deployment (Keycloak must be wired in), attacker must already possess or provision a Keycloak account (PR:L), and the username/email collision condition (AT:P/AC:H) must be satisfiable.

This is a medium-high severity authentication bypass (CVSS 4.0 base 7.7) in phpMyFAQ's Keycloak SSO integration, enabling full account takeover and superadmin escalation. The signals are mixed and point to a real-but-conditional issue rather than a mass-exploitation emergency. The provided CVSS 4.0 vector (AV:N/AC:H/AT:P/PR:L) correctly reflects meaningful friction: network reachable, but high attack complexity and an attack requirement (AT:P), plus the attacker must already control a Keycloak identity (PR:L). No EPSS score was provided, so exploitation probability cannot be quantified. The CVE is NOT in CISA KEV and no public POC is referenced, so exploitation status is 'no public exploit identified at time of analysis.' The impact triad is high (VC:H/VI:H/VA:H) because success yields superadmin control, but the scope-subsequent metrics are N, indicating no spillover to other systems. The single most important limiting factor - understated by raw severity - is that only pre-release builds (4.2.0-alpha through before 4.2.0-beta) are affected AND the deployment must have Keycloak SSO configured, drastically narrowing the real-world exploitable population. Net assessment: a legitimate priority for the specific organizations running phpMyFAQ 4.2.0 pre-release with Keycloak, but low urgency for the broader population.

An organization runs phpMyFAQ 4.2.0-alpha configured to use Keycloak for SSO, with an existing local superadmin account. An attacker who can register or control a Keycloak identity sets their preferred_username or an unverified email to match the superadmin's, then logs in through /auth/keycloak/authorize; phpMyFAQ implicitly links the attacker's Keycloak subject to the privileged local account, granting superadmin access. No public exploit code is referenced, so exploitation would currently require independent development against this specific pre-release.