CVE-2026-119429: phpMyAdmin through 5.2.3 Two-Factor Authentication Removal via /config/set

Published Oct 30, 2026

Updated

phpMyAdmin through 5.2.3 contains a missing re-authentication vulnerability that allows authenticated attackers to remove two-factor authentication by posting the 2fa key to /config/set. Attackers holding a hijacked session can submit key=2fa with a null JSON value to SetConfigController, stripping 2FA so later logins require only the MySQL password.

Event History

Oct 30, 2026

CVE Published

via MITRE·11:30 AM

Data Sourced

via MITRE·11:30 AM

DescriptionSeverityWeakness

Data Sourced

via NVD·12:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What access does an attacker need to remove the second factor?

The attacker must be authenticated with a hijacked phpMyAdmin session. No user interaction is required after the attacker has that session.

Which installations are in scope?

phpMyAdmin versions through 5.2.3 are affected. The issue is relevant where two-factor authentication is enabled, because the attack removes the stored 2FA configuration.

What is the practical effect of a successful attack?

The attacker can submit the 2fa configuration key with a null JSON value to /config/set, removing two-factor authentication. Subsequent logins then require only the MySQL password.

CVE-2026-119429: phpMyAdmin through 5.2.3 Two-Factor Authentication Removal via /config/set

Event History

Frequently Asked Questions

What access does an attacker need to remove the second factor?

Which installations are in scope?

What is the practical effect of a successful attack?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to remove the second factor?

Which installations are in scope?

What is the practical effect of a successful attack?