Keycloak Authentication Bypass Grants Superadmin Access

phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains an authentication bypass vulnerability that allows Keycloak users to take over local accounts by matching preferred_username or email. Attackers controlling a Keycloak identity with a colliding username or unverified email can log in through /auth/keycloak/authorize to bind their subject and gain superadmin privileges.

Casky was already ahead

This CVE exploits attack patterns that Casky's 283matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

phpMyFAQ 4.2.0-alpha before 4.2.0-beta contains a critical authentication bypass vulnerability in its Keycloak integration that allows attackers to hijack local user accounts and escalate to superadmin privileges. The vulnerability exploits unsafe account binding logic—when a Keycloak identity's preferred_username or email matches an existing phpMyFAQ account, the system automatically links them without proper verification. This is particularly dangerous because attackers controlling a Keycloak identity with a colliding username or unverified email can authenticate via /auth/keycloak/authorize and immediately gain administrative control. Organizations running phpMyFAQ with Keycloak-based single sign-on are at immediate risk, especially if they allow unverified email registration or use predictable usernames.

Casky's 283 mapped security skills leverage Claude AI's extended reasoning to identify the attack patterns underlying this vulnerability across MITRE ATT&CK techniques TA0004 (Privilege Escalation) and TA0006 (Credential Access). Practitioners using Casky will detect this exploitation through multiple findings: anomalous authentication patterns showing successful logins from unexpected Keycloak realms, privilege escalation events where standard users suddenly gain admin roles during /auth/keycloak/authorize requests, and account binding activities that bypass email verification workflows. The platform's AI-driven analysis will flag suspicious correlations between identity provider attributes (preferred_username, email claims) and local account creation timestamps, along with unusual permission assignments immediately following Keycloak authentication events. Security teams will gain clear visibility into whether their phpMyFAQ instances are vulnerable and which user accounts may have been compromised through this bypass mechanism.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

283 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-111898.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

identity access management · low

Run

MITRE ATT&CK Techniques

TA0004 TA0006

Investigate the attack patterns behind CVE-2026-111898

Casky has 283 skills that investigate the attack patterns behind CVE-2026-111898. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn