CVE-2026-119561Medium· 6.8▾ SunlitphpMyAdmin through 5.2.3 contains an authentication bypass vulnerability in CustomServer::parseAndValidateAssertionResponse() that never verifies WebAuthn assertion signatures against stored public keys. Attackers holding a victim's MySQ…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 37.4 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
phpMyAdmin through 5.2.3 contains an authentication bypass vulnerability in CustomServer::parseAndValidateAssertionResponse() that never verifies WebAuthn assertion signatures against stored public keys. Attackers holding a victim's MySQL credentials can POST a crafted webauthn_request_response with matching challenge, origin, and rpIdHash to bypass the second factor and gain database privileges.
phpMyAdmin <= 5.2.3Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-119426High· 7.5phpMyAdmin through 5.2.3 CSRF Token Bypass via Non-AJAX POST to /sql
CVE-2026-119429Medium· 4.3phpMyAdmin through 5.2.3 Two-Factor Authentication Removal via /config/set
CVE-2026-119563Medium· 5.4phpMyAdmin through 5.2.3 Stored XSS via Designer Query History Table Name
CVE-2026-119562Medium· 4.2phpMyAdmin through 5.2.3 SQL Injection via Central Columns col_extra and col_attribute
CVE-2026-119428Low· 3.7phpMyAdmin through 5.2.3 SSRF via setup/validate.php After Setup Disabled
CVE-2026-119427Medium· 4.2phpMyAdmin through 5.2.3 SQL Injection via Designer saveSetting