phpMyAdmin through 5.2.3 Two-Factor Authentication Removal via /config/set

Advisories

phpMyAdmin through 5.2.3 Two-Factor Authentication Removal via /config/set

Severity: medium
Date: 10/30/2026
Affecting: phpMyAdmin <= 5.2.3
CVE: CVE-2026-119429
CWE: CWE-620 Unverified Password Change
CVSS: 5.3
CVSS V4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
References: https://github.com/phpmyadmin/phpmyadmin/commit/b2a3e41f1e9ce42d1ee3f07a91f476029987799f
https://github.com/phpmyadmin/phpmyadmin/commit/6482dfa28bd56d515f482b008b194a516646fe1b
https://github.com/phpmyadmin/phpmyadmin/pull/19087
https://github.com/phpmyadmin/phpmyadmin/blob/RELEASE_5_2_3/libraries/classes/Controllers/Config/SetConfigController.php#L29-L41
https://abraxaslabs.tech/research/phpmyadmin-config-set-2fa
https://github.com/phpmyadmin/phpmyadmin
Credit: Abraxas Labs, Maurício Meneghini Fauth
Description: phpMyAdmin through 5.2.3 contains a missing re-authentication vulnerability that allows authenticated attackers to remove two-factor authentication by posting the 2fa key to /config/set. Attackers holding a hijacked session can submit key=2fa with a null JSON value to SetConfigController, stripping 2FA so later logins require only the MySQL password.

Ready to get Started?

Explore VulnCheck, a next-generation Cyber Threat Intelligence platform, which provides exploit and vulnerability intelligence to help you prioritize and remediate vulnerabilities that matter.

Vulnerability Prioritization
Prioritize vulnerabilities that matter based on the threat landscape and defer vulnerabilities that don't.
Early Warning System
Real-time alerting of changes in the vulnerability landscape so that you can take action before the attacks start.

Schedule a Demo