← CVE Radar
CVE-2026-119561phpMyAdmin through 5.2.3 WebAuthn Two-Factor Authentication Bypass via CustomServer
phpMyAdmin through 5.2.3 contains an authentication bypass vulnerability in CustomServer::parseAndValidateAssertionResponse() that never verifies WebAuthn assertion signatures against stored public keys. Attackers holding a victim's MySQL credentials can POST a crafted webauthn_request_response with matching challenge, origin, and rpIdHash to bypass the second factor and gain database privileges.
7.6 HIGHEPSS 0.20%Not in KEVNVD: Analyzed
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 7.6 | HIGH | 4.0VulnCheck (CNA) | CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N |
| 8.1 | HIGH | 3.1NVD | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N |
| 6.8 | MEDIUM | 3.1VulnCheck (CNA) | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N |
Details
- CVE ID
- CVE-2026-119561
- Status
- Analyzed
- Assigner (CNA)
- VulnCheck
- Published
- Oct 30, 2026
- Last modified
- 2026-11-03 16:06 UTC
- Weaknesses
- CWE-347 · Improper Verification of Cryptographic Signature
Affected Products
As published by the CNA in the CVE record.
phpMyAdminphpMyAdmin1 version range
- through 5.2.3
References
- abraxaslabs.tech https://abraxaslabs.tech/research/PMA-5.2.3-WebAuthn-2FA
- abraxaslabs.tech https://abraxaslabs.tech/research/phpmyadmin-webauthn
- github.com https://github.com/phpmyadmin/phpmyadmin
- github.com https://github.com/phpmyadmin/phpmyadmin/blob/RELEASE_5_2_3/libraries/classes/WebAuthn/CustomServer.php#L76-L110
- vulncheck.com https://www.vulncheck.com/advisories/phpmyadmin-through-5.2.3-webauthn-two-factor-authentication-bypass-via-customserver