Seven phpMyAdmin vulnerabilities expose users to account attacks

Seven phpMyAdmin vulnerabilities were disclosed on 30 October 2026, affecting all versions up to and including 5.2.3. The flaws span CSRF and WebAuthn bypasses, an SSRF weakness, two SQL injection vectors and a stored script injection, with one bypass able to remove two-factor protections. No exploits in the wild are confirmed as of the disclosure, and there is no public PoC code cited for these bugs.

The advisories list seven CVEs in total, led by CVE-2026-119426 (CSRF Token Bypass via Non-AJAX POST to /sql) with a CVSSv4 score of 7.7, and followed by CVE-2026-119561 (WebAuthn Two-Factor Authentication Bypass via CustomServer) at 7.6, along with CVE-2026-119428 (SSRF via setup/validate.php After Setup Disabled) at 6.3, CVE-2026-119429 (Two-Factor Authentication Removal via

/config/set) at 5.3, CVE-2026-119563 (Stored XSS via Designer Query History Table Name) at 5.1, and CVE-2026-119427 and CVE-2026-119562 (SQL Injection via Designer saveSetting and Central Columns respectively) at 2.3 each.

The piece explains how the attack paths operate: forged requests can execute SQL commands on behalf of an authenticated user; WebAuthn signatures may be bypassed, and a vulnerable setup script can be induced to reveal internal network details or permit arbitrary host/port values. Attackers could also craft tables or settings that enable SQL injection or stored script execution in designer modes.

Mitigation focuses on applying the latest phpMyAdmin release (through 5.2.3 fixed), updating to the newest build, and restricting exposure by placing phpMyAdmin behind private networks or VPNs and disabling public access to setup scripts. The summary attributes claims to SecurityOnline[.]info and its researchers, with the CVEs enumerated as cited above. The affected line is “through 5.2.3” for all listed CVEs. No further conclusions are drawn beyond the article’s stated findings.