A flaw in phpMyFAQ allows an attacker who has a valid or stolen Identity Provider (IdP) credential to complete an OIDC authentication flow and obtain a fully authenticated session, including administrator accounts, while circumventing the application’s TOTP two‑factor authentication. The vulnerability originates in the handling of SSO callback requests from Keycloak and Entra ID, permitting the IdP‑authenticated user to skip the 2FA step. This constitutes a classic credential‑reuse issue (CWE‑287) that can lead to full system compromise.

Installations of phpMyFAQ shall become aware that versions 3.2.0‑alpha up to but not including 4.1.9 and 4.2.0‑alpha up to but not including 4.2.0‑beta are affected. The product is maintained by the vendor thorsten. Any deployment using these specific releases is susceptible until an update is applied.

The CVSS score of 8.6 indicates high severity, and without a known EPSS estimate the exploitation probability appears uncertain; the vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalogue. Granted that an attacker must first obtain a valid IdP identity linked to a 2FA‑enabled phpMyFAQ account, once this is in hand the bypass can be executed remotely via the SSO callback mechanism, potentially granting administrative privileges.