---
id: CVE-2026-46359
title: >-
  phpMyFAQ - SQL Injection in CurrentUser::setTokenData via Unescaped OAuth
  Token Fields
summary: >-
  phpMyFAQ before 4.1.2 contains a sql injection vulnerability in
  CurrentUser::setTokenData that allows authenticated attackers to execute
  arbitrary SQL by injecting malicious OAuth token claims. Attackers with Azure
  AD accounts containing…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H'
cvssSource: cna
cwe:
  - CWE-89
vendor: thorsten
product: phpmyfaq
affected:
  - phpmyfaq < 4.1.2
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-05-15T21:12:51.070439Z'
exploitAvailable: true
published: '2026-05-15'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:03:51.792Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-46359'
references:
  - url: >-
      https://github.com/thorsten/phpMyFAQ/security/advisories/GHSA-pm8c-3qq3-72w7
    label: GitHub Security Advisory (GHSA-pm8c-3qq3-72w7)
  - url: >-
      https://www.vulncheck.com/advisories/phpmyfaq-sql-injection-in-currentuser-settokendata-via-unescaped-oauth-token-fields
    label: >-
      VulnCheck Advisory: phpMyFAQ - SQL Injection in CurrentUser::setTokenData
      via Unescaped OAuth Token Fields
tags:
  - cve.org
  - exploit-available
epss: 0.00264
epssPercentile: 0.18407
ingestedAt: '2026-11-08T14:51:22.420Z'
---

## Overview

phpMyFAQ before 4.1.2 contains a sql injection vulnerability in CurrentUser::setTokenData that allows authenticated attackers to execute arbitrary SQL by injecting malicious OAuth token claims. Attackers with Azure AD accounts containing SQL metacharacters in display names or JWT claims can break out of string literals and execute arbitrary database queries.

## Affected

- `phpmyfaq < 4.1.2`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.