CVE-2026-119561— phpMyAdmin through 5.2.3 WebAuthn Two-Factor Authentication Bypass via CustomServer

Quick assessment

Affected

phpMyAdmin phpMyAdmin

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

phpMyAdmin 5.2.3 及更早版本在函数中存在身份验证绕过漏洞。该函数从未将 WebAuthn 断言签名与存储的公钥进行验证。若攻击者已获取受害者的 MySQL 凭据，即可通过 POST 一个精心构造的（其中包含匹配的 challenge、origin 和 rpIdHash），从而绕过第二因素验证并获取数据库权限。

CVSS 6.8 · Medium Updated Oct 30, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

phpMyAdmin through 5.2.3 WebAuthn Two-Factor Authentication Bypass via CustomServer

Source: CVE Program / CVE List V5

Vulnerability Description

phpMyAdmin through 5.2.3 contains an authentication bypass vulnerability in CustomServer::parseAndValidateAssertionResponse() that never verifies WebAuthn assertion signatures against stored public keys. Attackers holding a victim's MySQL credentials can POST a crafted webauthn_request_response with matching challenge, origin, and rpIdHash to bypass the second factor and gain database privileges.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

密码学签名的验证不恰当

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
phpMyAdmin	phpMyAdmin	0 ~ 5.2.3	-

II. Public POCs for CVE-2026-119561

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-119561

请登录查看更多情报信息。

Other References for CVE-2026-119561 (5)

https://abraxaslabs.tech/research/phpmyadmin-webauthn third-party-advisory
https://github.com/phpmyadmin/phpmyadmin product
https://abraxaslabs.tech/research/PMA-5.2.3-WebAuthn-2FA third-party-advisory
https://github.com/phpmyadmin/phpmyadmin/blob/RELEASE_5_2_3/libraries/classes/WebAuthn/CustomServer.php#L76-L110 technical-description
https://www.vulncheck.com/advisories/phpmyadmin-through-5.2.3-webauthn-two-factor-authentication-bypass-via-customserver third-party-advisory

https://www.cve.org/CVERecord?id=CVE-2026-119561

Same Patch Batch · phpMyAdmin · 2026-10-30 · 7 CVEs total

CVE-2026-119426	7.5 HIGH	phpMyAdmin through 5.2.3 CSRF Token Bypass via Non-AJAX POST to /sql
CVE-2026-119563	5.4 MEDIUM	phpMyAdmin through 5.2.3 Stored XSS via Designer Query History Table Name
CVE-2026-119429	4.3 MEDIUM	phpMyAdmin through 5.2.3 Two-Factor Authentication Removal via /config/set
CVE-2026-119427	4.2 MEDIUM	phpMyAdmin through 5.2.3 SQL Injection via Designer saveSetting
CVE-2026-119562	4.2 MEDIUM	phpMyAdmin through 5.2.3 SQL Injection via Central Columns col_extra and col_attribute
CVE-2026-119428	3.7 LOW	phpMyAdmin through 5.2.3 SSRF via setup/validate.php After Setup Disabled

IV. Related Vulnerabilities

Same product: phpMyAdmin

Same vendor: phpMyAdmin

Same weakness: CWE-347