phpMyFAQ versions 4.2.0‑alpha up to before 4.2.0‑beta allow an attacker to bypass authentication by exploiting the Keycloak integration. The flaw lets a Keycloak user with a colliding preferred_username or unverified email bind their Keycloak subject to a local account through the /auth/keycloak/authorize endpoint, resulting in superadmin privileges for the attacker. This can compromise the entire system and any data managed by phpMyFAQ.

The affected product is phpMyFAQ, developed by thorsten, a web‑based FAQ management system. The vulnerability exists in releases 4.2.0‑alpha through just before 4.2.0‑beta; all earlier 4.1.x or 4.0.x versions are unaffected. Users running the vulnerable releases should verify their installed version against the vendor’s release notes.

The CVSS score of 7.7 indicates a high severity. Because EPSS data is unavailable, the exact likelihood of exploitation cannot be quantified, but the vulnerability is not listed in the CISA KEV catalog. An attacker must control a Keycloak identity that matches a local preferred_username or uses an unverified email. Once they craft a request to /auth/keycloak/authorize, the system automatically links the identities, causing an authentication bypass and privilege escalation.