CVE-2026-46359: phpMyFAQ SQL Injection via OAuth Token Claims

The National Vulnerability Database has disclosed CVE-2026-46359, a high-severity SQL injection vulnerability affecting phpMyFAQ installations prior to version 4.1.2. This flaw resides within the CurrentUser::setTokenData function, allowing authenticated attackers to execute arbitrary SQL queries by injecting malicious OAuth token claims.

Attackers can exploit this by crafting Azure AD accounts where display names or JWT claims contain SQL metacharacters. This enables them to break out of string literals within the application’s database interactions, leading to arbitrary database query execution. The CVSS score for this vulnerability is 7.5 (High), indicating significant impact on confidentiality, integrity, and availability.

This isn’t a theoretical issue; it’s a critical bypass for authentication and authorization. Any organization using phpMyFAQ with OAuth integrations, especially those leveraging Azure AD, needs to understand that a compromised or malicious Azure AD account can directly translate into full database compromise. The attacker’s calculus here is clear: leverage a trusted identity provider’s data to gain unauthorized access and control over the target application’s data.