CVE-2026-1195617.6High
phpMyAdmin through 5.2.3 WebAuthn Two-Factor Authentication Bypass via CustomServer
Not in CISA KEV
0.2%probability of exploitation in the next 30 days
8th percentile
050100
Higher than 8% of scored CVEs
7.6HighCVSS
LowMediumHighCrit.
DescriptionNVD
phpMyAdmin through 5.2.3 contains an authentication bypass vulnerability in CustomServer::parseAndValidateAssertionResponse() that never verifies WebAuthn assertion signatures against stored public keys. Attackers holding a victim's MySQL credentials can POST a crafted webauthn_request_response with matching challenge, origin, and rpIdHash to bypass the second factor and gain database privileges.
Coverage1 article · 1 outlet
First in our coverage: SecurityOnline, 3 Nov.
- Seven phpMyAdmin vulnerabilities expose users to account attacksSecurityOnline · first in our coverage · mentions it in passing
New articles also arrive in the RSS feed.