Vulnerability · Published Oct 30, 2026 · Assigned by VulnCheck

CVE-2026-119561phpMyAdmin through 5.2.3 WebAuthn Two-Factor Authentication Bypass via CustomServer

Medium 6.8

In plain English

A medium-severity security flaw in phpMyAdmin from phpMyAdmin. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).

Severity (CVSS 3.1)6.8Medium

Exploit odds (30 days)0.2%top 89.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

phpMyAdmin through 5.2.3 contains an authentication bypass vulnerability in CustomServer::parseAndValidateAssertionResponse() that never verifies WebAuthn assertion signatures against stored public keys. Attackers holding a victim's MySQL credentials can POST a crafted webauthn_request_response with matching challenge, origin, and rpIdHash to bypass the second factor and gain database privileges.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	phpmyadmin	no fix listed	DEBIAN-CVE-2026-119561
Debian:13	phpmyadmin	no fix listed	DEBIAN-CVE-2026-119561
Debian:14	phpmyadmin	no fix listed	DEBIAN-CVE-2026-119561
Ubuntu:22.04:LTS	phpmyadmin	no fix listed	UBUNTU-CVE-2026-119561
Ubuntu:24.04:LTS	phpmyadmin	no fix listed	UBUNTU-CVE-2026-119561
Ubuntu:26.04:LTS	phpmyadmin	no fix listed	UBUNTU-CVE-2026-119561
Ubuntu:26.10	phpmyadmin	no fix listed	UBUNTU-CVE-2026-119561

Affected products (as reported)

Vendor	Product	Versions
phpMyAdmin	phpMyAdmin	0 – through 5.2.3

Weakness: CWE-347 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N

References

https://github.com/phpmyadmin/phpmyadmin/blob/RELEASE_5_2_3/libraries/classes/WebAuthn/CustomServer.php#L76-L110 technical-description
https://abraxaslabs.tech/research/PMA-5.2.3-WebAuthn-2FA third-party-advisory
https://abraxaslabs.tech/research/phpmyadmin-webauthn third-party-advisory
https://github.com/phpmyadmin/phpmyadmin product
VulnCheck Advisory: phpMyAdmin through 5.2.3 WebAuthn Two-Factor Authentication Bypass via CustomServer third-party-advisory