Medium severity4.3NVD Advisory· Published Oct 30, 2026
CVE-2026-119429
CVE-2026-119429
Description
phpMyAdmin through 5.2.3 contains a missing re-authentication vulnerability that allows authenticated attackers to remove two-factor authentication by posting the 2fa key to /config/set. Attackers holding a hijacked session can submit key=2fa with a null JSON value to SetConfigController, stripping 2FA so later logins require only the MySQL password.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <=5.2.3
Patches
Vulnerability mechanics
References
6- abraxaslabs.tech/research/phpmyadmin-config-set-2fanvd
- github.com/phpmyadmin/phpmyadmin/blob/RELEASE_5_2_3/libraries/classes/Controllers/Config/SetConfigController.phpnvd
- github.com/phpmyadmin/phpmyadmin/commit/6482dfa28bd56d515f482b008b194a516646fe1bnvd
- github.com/phpmyadmin/phpmyadmin/commit/b2a3e41f1e9ce42d1ee3f07a91f476029987799fnvd
- github.com/phpmyadmin/phpmyadmin/pull/19087nvd
- www.vulncheck.com/advisories/phpmyadmin-through-5.2.3-two-factor-authentication-removal-via-config-setnvd
News mentions
0No linked articles in our index yet.