Live › vulnerability › CVE-2026-119429
phpMyAdmin through 5.2.3 lets anyone holding an authenticated session remove two-factor authentication by posting to its config endpoint without re-authenticating. After that, logins need only the MySQL password.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 12:30 UTC. All times on this page are UTC.
Teams that run phpMyAdmin with two-factor authentication enabled and expose it to users. The attacker first needs a hijacked authenticated session, so exposure depends on how sessions are protected. Installations without two-factor authentication are not affected by the stripping step.
No product ranges from the sources yet.
phpMyAdmin version shown on the login page or in libraries/classes/Version.php (or the package manager).5.2.3 are implied as affected-range boundary; the sources do not state a fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
phpMyAdmin through 5.2.3 contains a missing re-authentication vulnerability that allows authenticated attackers to remove two-factor authentication by posting the 2fa key to /config/set. Attackers holding a hijacked session can submit key=2fa with a null JSON value to SetConfigController, stripping 2FA so later logins require only the MySQL password.
This page as .md · .json · in your agent: get_signal("CVE-2026-119429")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.