{"id":"CVE-2026-119561","published":"2026-10-30T12:16:43.513","lastModified":"2026-10-30T19:14:38.697","description":"phpMyAdmin through 5.2.3 contains an authentication bypass vulnerability in CustomServer::parseAndValidateAssertionResponse() that never verifies WebAuthn assertion signatures against stored public keys. Attackers holding a victim's MySQL credentials can POST a crafted webauthn_request_response with matching challenge, origin, and rpIdHash to bypass the second factor and gain database privileges.","cvssScore":6.8,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N","cwes":["CWE-347"],"vendors":[],"products":[],"references":[{"url":"https://abraxaslabs.tech/research/PMA-5.2.3-WebAuthn-2FA","tags":[]},{"url":"https://abraxaslabs.tech/research/phpmyadmin-webauthn","tags":[]},{"url":"https://github.com/phpmyadmin/phpmyadmin","tags":[]},{"url":"https://github.com/phpmyadmin/phpmyadmin/blob/RELEASE_5_2_3/libraries/classes/WebAuthn/CustomServer.php#L76-L110","tags":[]},{"url":"https://www.vulncheck.com/advisories/phpmyadmin-through-5.2.3-webauthn-two-factor-authentication-bypass-via-customserver","tags":[]}],"exploitRefs":[{"url":"https://github.com/phpmyadmin/phpmyadmin","tags":[]},{"url":"https://github.com/phpmyadmin/phpmyadmin/blob/RELEASE_5_2_3/libraries/classes/WebAuthn/CustomServer.php#L76-L110","tags":[]}],"hasPoc":true,"ai":null}