Live › vulnerability › CVE-2026-119561
phpMyAdmin through 5.2.3 does not check WebAuthn assertion signatures against stored public keys during login. An attacker who already holds a victim's MySQL credentials can submit a crafted response to skip the second factor and gain database privileges.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 12:30 UTC. All times on this page are UTC.
Teams that run phpMyAdmin 5.2.3 or earlier with WebAuthn two-factor login enabled are exposed, since the flaw sits in the second-factor check. Attackers must already have a valid MySQL username and password, so installations without WebAuthn 2FA are less exposed. Sources do not state whether default configurations enable WebAuthn.
No product ranges from the sources yet.
5.2.3 or earlier.5.2.3; the sources do not name the fixed version.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
phpMyAdmin through 5.2.3 contains an authentication bypass vulnerability in CustomServer::parseAndValidateAssertionResponse() that never verifies WebAuthn assertion signatures against stored public keys. Attackers holding a victim's MySQL credentials can POST a crafted webauthn_request_response with matching challenge, origin, and rpIdHash to bypass the second factor and gain database privileges.
This page as .md · .json · in your agent: get_signal("CVE-2026-119561")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.