CVE WATCH / VULNERABILITY DETAIL
CVE-2026-111895
MEDIUMCVSS 6.8NVD feed
Published 17 October 2026 · tracked since 18 October 2026
Description
phpMyFAQ 3.2.0 before 4.0.0 and 4.0.2 before 4.2.0-beta contains an authentication bypass in its Microsoft Entra ID login flow, which links users by the mutable preferred_username claim and whose AuthEntraId::create() ignores the duplicate-login exception while continuing with the existing local acc
References
- NVD — National Vulnerability Database
- CVE.org record (MITRE)
- CISA Known Exploited Vulnerabilities catalog
Latest tracked vulnerabilities
- CVE-2026-111866 HIGH 7.3
- CVE-2026-111931 MEDIUM 4.3
- CVE-2026-111934 LOW 3.7
- CVE-2026-111927 HIGH 7.7
- CVE-2026-111916 MEDIUM 5.3
- CVE-2026-111922 MEDIUM 6.3
- CVE-2026-111908 HIGH 8.3
- CVE-2026-111909 HIGH 8.1
- CVE-2026-111910 MEDIUM 6.5
- CVE-2026-111911 CRITICAL 9.8