SSO Authentication Bypass Skips Two-Factor Verification

phpMyFAQ 3.2.0-alpha before 4.1.9 and 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows IdP-authenticated users to skip TOTP two-factor authentication through the Keycloak and Entra ID SSO callbacks. Attackers holding a valid or phished IdP identity linked to a 2FA-enabled account can complete the OIDC flow and obtain a fully authenticated session, including administrator accounts.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

phpMyFAQ versions 3.2.0-alpha through 4.1.9 and 4.2.0-alpha through 4.2.0-beta contain a critical authentication bypass flaw in their Keycloak and Entra ID SSO integration. The vulnerability allows attackers to skip TOTP two-factor authentication during the OIDC callback flow, enabling full session authentication including administrator access. This affects any organization using phpMyFAQ with federated identity providers and 2FA protection enabled. The attack is particularly dangerous because threat actors need only a valid IdP identity—either legitimately obtained or through phishing—to bypass the secondary authentication layer that should protect sensitive accounts.

Casky's 283 mapped security skills enable detection of this vulnerability through extended Claude reasoning across MITRE ATT&CK techniques TA0004 (Privilege Escalation) and TA0006 (Credential Access). Practitioners using Casky would identify attack patterns including: anomalous session establishment without 2FA challenge logging, successful admin-level authentications originating from SSO callbacks that lack TOTP verification records, and lateral movement patterns consistent with compromised IdP credentials bypassing expected authentication gates. The platform's skill-based analysis would flag deviations in OIDC token processing, missing conditional access enforcement, and authentication flow logs showing completed sessions for users who should have triggered MFA challenges. Security teams can correlate these findings with IdP logs to detect coordinated phishing campaigns targeting federated accounts linked to 2FA-protected administrative roles.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-111882.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-111882

Casky has 283 skills that investigate the attack patterns behind CVE-2026-111882. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn