Bug 2563933 (CVE-2026-119429) - CVE-2026-119429 phpMyAdmin: phpMyAdmin: Removal of two-factor authentication via missing re-authentication
Summary: CVE-2026-119429 phpMyAdmin: phpMyAdmin: Removal of two-factor authentication ...
Keywords:
Status: NEW
Alias: CVE-2026-119429
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2565563 2565565 2565566 2565567 2565568
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-10-30 11:44 UTC by OSIDB Bzimport
Modified: 2026-11-03 02:50 UTC (History)
0 users

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-10-30 11:44:18 UTC 
phpMyAdmin through 5.2.3 contains a missing re-authentication vulnerability that allows authenticated attackers to remove two-factor authentication by posting the 2fa key to /config/set. Attackers holding a hijacked session can submit key=2fa with a null JSON value to SetConfigController, stripping 2FA so later logins require only the MySQL password.
Note You need to log in before you can comment on or make changes to this bug.