---
id: CVE-2026-119429
title: phpMyAdmin through 5.2.3 Two-Factor Authentication Removal via /config/set
summary: >-
  phpMyAdmin through 5.2.3 contains a missing re-authentication vulnerability
  that allows authenticated attackers to remove two-factor authentication by
  posting the 2fa key to /config/set. Attackers holding a hijacked session can
  submit ke…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-620
vendor: phpMyAdmin
product: phpMyAdmin
affected:
  - phpMyAdmin <= 5.2.3
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-30T15:21:00.472324Z'
published: '2026-10-30'
updated: '2026-10-30'
sourceUpdated: '2026-10-30T15:54:53.572Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-119429'
references:
  - url: >-
      https://github.com/phpmyadmin/phpmyadmin/commit/b2a3e41f1e9ce42d1ee3f07a91f476029987799f
  - url: >-
      https://github.com/phpmyadmin/phpmyadmin/commit/6482dfa28bd56d515f482b008b194a516646fe1b
  - url: 'https://github.com/phpmyadmin/phpmyadmin/pull/19087'
  - url: >-
      https://github.com/phpmyadmin/phpmyadmin/blob/RELEASE_5_2_3/libraries/classes/Controllers/Config/SetConfigController.php#L29-L41
  - url: 'https://abraxaslabs.tech/research/phpmyadmin-config-set-2fa'
  - url: 'https://github.com/phpmyadmin/phpmyadmin'
  - url: >-
      https://www.vulncheck.com/advisories/phpmyadmin-through-5.2.3-two-factor-authentication-removal-via-config-set
    label: >-
      VulnCheck Advisory: phpMyAdmin through 5.2.3 Two-Factor Authentication
      Removal via /config/set
tags:
  - cve.org
epss: 0.00402
epssPercentile: 0.34644
ingestedAt: '2026-11-05T16:07:30.525Z'
---

## Overview

phpMyAdmin through 5.2.3 contains a missing re-authentication vulnerability that allows authenticated attackers to remove two-factor authentication by posting the 2fa key to /config/set. Attackers holding a hijacked session can submit key=2fa with a null JSON value to SetConfigController, stripping 2FA so later logins require only the MySQL password.

## Affected

- `phpMyAdmin <= 5.2.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.