CVE-2026-1194295.3Medium
phpMyAdmin through 5.2.3 Two-Factor Authentication Removal via /config/set
Not in CISA KEVVendor fix available
0.4%probability of exploitation in the next 30 days
31st percentile
050100
Higher than 31% of scored CVEs
5.3MediumCVSS
LowMediumHighCrit.
DescriptionNVD
phpMyAdmin through 5.2.3 contains a missing re-authentication vulnerability that allows authenticated attackers to remove two-factor authentication by posting the 2fa key to /config/set. Attackers holding a hijacked session can submit key=2fa with a null JSON value to SetConfigController, stripping 2FA so later logins require only the MySQL password.
Coverage1 article · 1 outlet
First in our coverage: SecurityOnline, 3 Nov.
- Seven phpMyAdmin vulnerabilities expose users to account attacksSecurityOnline · first in our coverage · mentions it in passing
New articles also arrive in the RSS feed.