UBUNTU-CVE-2026-119561: High severity ubuntu/phpmyadmin vulnerability
phpMyAdmin through 5.2.3 contains an authentication bypass vulnerability in CustomServer::parseAndValidateAssertionResponse() that never verifies WebAuthn assertion signatures against stored public keys. Attackers holding a victim's MySQL credentials can POST a crafted webauthnrequestresponse with matching challenge, origin, and rpIdHash to bypass the second factor and gain database privileges.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this vulnerability?
phpMyAdmin deployments through 5.2.3 are exposed where WebAuthn is used as a second authentication factor. An attacker must already possess the targeted user's MySQL credentials.
What does an attacker need to bypass the second factor?
The attacker needs the victim's MySQL credentials and must submit a crafted webauthn_request_response containing a matching challenge, origin, and rpIdHash. The vulnerable code does not verify the WebAuthn assertion signature against the stored public key.
What access can an attacker obtain?
Successful exploitation bypasses the WebAuthn second factor and grants the attacker the database privileges associated with the compromised MySQL account.