CVE-2026-119429— phpMyAdmin through 5.2.3 Two-Factor Authentication Removal via /config/set

Quick assessment

Affected

phpMyAdmin phpMyAdmin

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

phpMyAdmin 5.2.3 及更早版本存在缺少重新认证的安全漏洞。已认证的攻击者可通过向接口提交 2FA 密钥，移除双因素认证（2FA）。若攻击者劫持了用户的会话，可向提交并将值设为空 JSON，从而禁用 2FA。此后，用户登录将仅需提供 MySQL 密码，不再需要双因素验证。

CVSS 4.3 · Medium Updated Oct 30, 2026

Possible ATT&CK Techniques 3 AI

T1551 T1078 · Valid Accounts T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

phpMyAdmin through 5.2.3 Two-Factor Authentication Removal via /config/set

Source: CVE Program / CVE List V5

Vulnerability Description

phpMyAdmin through 5.2.3 contains a missing re-authentication vulnerability that allows authenticated attackers to remove two-factor authentication by posting the 2fa key to /config/set. Attackers holding a hijacked session can submit key=2fa with a null JSON value to SetConfigController, stripping 2FA so later logins require only the MySQL password.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

未经验证的口令修改

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
phpMyAdmin	phpMyAdmin	0 ~ 5.2.3	-

II. Public POCs for CVE-2026-119429

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-119429

请登录查看更多情报信息。

Other References for CVE-2026-119429 (7)

https://github.com/phpmyadmin/phpmyadmin/commit/b2a3e41f1e9ce42d1ee3f07a91f476029987799f patch
https://github.com/phpmyadmin/phpmyadmin/blob/RELEASE_5_2_3/libraries/classes/Controllers/Config/SetConfigController.php#L29-L41 technical-description
https://github.com/phpmyadmin/phpmyadmin product
https://github.com/phpmyadmin/phpmyadmin/commit/6482dfa28bd56d515f482b008b194a516646fe1b patch
https://abraxaslabs.tech/research/phpmyadmin-config-set-2fa third-party-advisory
https://github.com/phpmyadmin/phpmyadmin/pull/19087 patch issue-tracking
https://www.vulncheck.com/advisories/phpmyadmin-through-5.2.3-two-factor-authentication-removal-via-config-set third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-119429

Same Patch Batch · phpMyAdmin · 2026-10-30 · 7 CVEs total

CVE-2026-119426	7.5 HIGH	phpMyAdmin through 5.2.3 CSRF Token Bypass via Non-AJAX POST to /sql
CVE-2026-119561	6.8 MEDIUM	phpMyAdmin through 5.2.3 WebAuthn Two-Factor Authentication Bypass via CustomServer
CVE-2026-119563	5.4 MEDIUM	phpMyAdmin through 5.2.3 Stored XSS via Designer Query History Table Name
CVE-2026-119427	4.2 MEDIUM	phpMyAdmin through 5.2.3 SQL Injection via Designer saveSetting
CVE-2026-119562	4.2 MEDIUM	phpMyAdmin through 5.2.3 SQL Injection via Central Columns col_extra and col_attribute
CVE-2026-119428	3.7 LOW	phpMyAdmin through 5.2.3 SSRF via setup/validate.php After Setup Disabled

IV. Related Vulnerabilities

Same product: phpMyAdmin

Same vendor: phpMyAdmin

Same weakness: CWE-620