CVE-2026-119429Medium· 4.3▾ SunlitphpMyAdmin through 5.2.3 contains a missing re-authentication vulnerability that allows authenticated attackers to remove two-factor authentication by posting the 2fa key to /config/set. Attackers holding a hijacked session can submit ke…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.4%
phpMyAdmin through 5.2.3 contains a missing re-authentication vulnerability that allows authenticated attackers to remove two-factor authentication by posting the 2fa key to /config/set. Attackers holding a hijacked session can submit key=2fa with a null JSON value to SetConfigController, stripping 2FA so later logins require only the MySQL password.
phpMyAdmin <= 5.2.3Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-119561Medium· 6.8phpMyAdmin through 5.2.3 WebAuthn Two-Factor Authentication Bypass via CustomServer
CVE-2026-119426High· 7.5phpMyAdmin through 5.2.3 CSRF Token Bypass via Non-AJAX POST to /sql
CVE-2026-119563Medium· 5.4phpMyAdmin through 5.2.3 Stored XSS via Designer Query History Table Name
CVE-2026-119562Medium· 4.2phpMyAdmin through 5.2.3 SQL Injection via Central Columns col_extra and col_attribute
CVE-2026-119428Low· 3.7phpMyAdmin through 5.2.3 SSRF via setup/validate.php After Setup Disabled
CVE-2026-119427Medium· 4.2phpMyAdmin through 5.2.3 SQL Injection via Designer saveSetting