phpMyFAQ versions 3.2.0 through 4.0.0 and 4.2.0‑beta implement an authentication bypass in their Microsoft Entra ID login. The flaw arises because the application links local accounts to Entra identities using the mutable preferred_username claim and ignores duplicate‑login exceptions during account creation. This allows an attacker controlling an identity within the configured tenant that shares a preferred_username with an existing local user to hijack that account, including accounts with super‑admin privileges. The weakness is a classic authentication bypass, reflected in CWE‑287.

phpMyFAQ, a PHP‑based FAQ application, is affected for releases 3.2.0 up to but not including 4.0.0, as well as 4.0.2 up to but not including 4.2.0‑beta. The vulnerability is specific to the Microsoft Entra ID login flow in these versions.

The CVSS score of 7.6 indicates a high severity authentication bypass. EPSS data is not available, so the current public exploitation probability is unknown. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to control an Entra ID that resides in the tenant configured for the application and possess a preferred_username matching that of a target local account. No special access beyond Entra identity ownership is required, making the attack relatively straightforward for insiders or compromised tenants.