{"id":"CVE-2026-119429","kind":"vulnerability","aliases":["CVE-2026-119429"],"related":[],"title":"phpMyAdmin: hijacked session can strip two-factor authentication","description":"phpMyAdmin through 5.2.3 contains a missing re-authentication vulnerability that allows authenticated attackers to remove two-factor authentication by posting the 2fa key to /config/set. Attackers holding a hijacked session can submit key=2fa with a null JSON value to SetConfigController, stripping 2FA so later logins require only the MySQL password.","summary":"phpMyAdmin through 5.2.3 lets anyone holding an authenticated session remove two-factor authentication by posting to its config endpoint without re-authenticating. After that, logins need only the MySQL password.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["mysql","phpmyadmin","runtime","self-hosted"],"not_affected_if":["no-2fa-configured","session-protected"],"how_to_check":"- Check the installed version: `phpMyAdmin` version shown on the login page or in `libraries/classes/Version.php` (or the package manager).\n- Confirm whether two-factor authentication is enabled for phpMyAdmin accounts in the configuration.","fix":"- Versions after `5.2.3` are implied as affected-range boundary; the sources do not state a fixed version.","status":"open","published_at":"2026-10-30T12:16:40+00:00","first_seen_at":"2026-10-30T12:30:25+00:00","triaged_at":"2026-10-30T12:32:59+00:00","updated_at":"2026-10-30T12:32:59+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-30T12:32:59Z","model":"claude-haiku-5-5","output":{"fix":"- Versions after `5.2.3` are implied as affected-range boundary; the sources do not state a fixed version.","reach":"internet","title":"phpMyAdmin: hijacked session can strip two-factor authentication","impact":"medium","summary":"phpMyAdmin through 5.2.3 lets anyone holding an authenticated session remove two-factor authentication by posting to its config endpoint without re-authenticating. After that, logins need only the MySQL password.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["phpmyadmin","self-hosted","mysql"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"attacker removes two-factor login protection from phpMyAdmin accounts","analyst_note":"Confirm the fixed phpMyAdmin version and whether a patch exists; the NVD entry in the sources does not state one.","how_to_check":"- Check the installed version: `phpMyAdmin` version shown on the login page or in `libraries/classes/Version.php` (or the package manager).\n- Confirm whether two-factor authentication is enabled for phpMyAdmin accounts in the configuration.","plain_action":"","needs_analyst":true,"not_affected_if":["no-2fa-configured","session-protected"],"who_is_affected":"Teams that run phpMyAdmin with two-factor authentication enabled and expose it to users. The attacker first needs a hijacked authenticated session, so exposure depends on how sessions are protected. Installations without two-factor authentication are not affected by the stripping step.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000707,"input_tokens":4152,"output_tokens":583,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119429':12A,15A '-2026':11A,14A '/config/set':80C '2fa':77C,89C,98C '5.2.3':24B,56C 'allow':65C 'anyon':26B 'attack':67C,81C 'authent':9A,29B,35B,45B,62C,66C,73C 'config':40B 'contain':57C 'cve':10A,13A 'endpoint':41B 'factor':8A,34B,72C 'hijack':2A,84C 'hold':27B,82C 'host':21B 'json':93C 'key':78C,88C 'later':100C 'let':25B 'login':48B,101C 'miss':59C 'mysql':16B,52B,105C 'need':49B 'null':92C 'password':53B,106C 'phpmyadmin':1A,17B,22B,54C 'post':37B,75C 're':44B,61C 're-authent':43B,60C 'remov':31B,69C 'requir':102C 'runtim':18B 'self':20B 'self-host':19B 'session':3A,30B,85C 'setconfigcontrol':96C 'strip':5A,97C 'submit':87C 'two':7A,33B,71C 'two-factor':6A,32B,70C 'valu':94C 'vulner':63C 'without':42B","nicknames":[],"mitigations":[],"who_affected":"Teams that run phpMyAdmin with two-factor authentication enabled and expose it to users. The attacker first needs a hijacked authenticated session, so exposure depends on how sessions are protected. Installations without two-factor authentication are not affected by the stripping step.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T12:16:40+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119429","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119429","severity":null,"published_at":"2026-10-30T12:16:40+00:00","modified_at":"2026-10-30T12:16:40+00:00","first_seen_at":"2026-10-30T12:30:25+00:00","fetched_at":"2026-10-30T12:30:25+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}