Vulnerability in phpMyAdmin

[ Description ]Official description

phpMyAdmin through 5.2.3 contains an authentication bypass vulnerability in CustomServer::parseAndValidateAssertionResponse() that never verifies WebAuthn assertion signatures against stored public keys. Attackers holding a victim's MySQL credentials can POST a crafted webauthn_request_response with matching challenge, origin, and rpIdHash to bypass the second factor and gain database privileges.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ Advisories ]Government CERT advisories

• BSI CERT-Bund1 Nov 2026WID-SEC-2026-4278

  phpMyAdmin: Multiple vulnerabilities Translated from German

  CVE-2026-119426CVE-2026-119562CVE-2026-119561+4 more CVEs

[ References ]References

• abraxaslabs.tech/research/PMA-5.2.3-WebAuthn-2FAExploitMitigationThird Party Advisory
• abraxaslabs.tech/research/phpmyadmin-webauthnExploitThird Party Advisory
• github.com/phpmyadmin/phpmyadminProduct
• github.com/phpmyadmin/phpmyadmin/blob/RELEASE_5_2_3/libraries/classes/WebAuthn/CustomSe…Product
• www.vulncheck.com/advisories/phpmyadmin-through-5.2.3-webauthn-two-factor-authenticatio…ExploitThird Party Advisory