CVE-2026-119429 in phpMyAdmin
Summary
by MITRE • 10/30/2026
phpMyAdmin through 5.2.3 contains a missing re-authentication vulnerability that allows authenticated attackers to remove two-factor authentication by posting the 2fa key to /config/set. Attackers holding a hijacked session can submit key=2fa with a null JSON value to SetConfigController, stripping 2FA so later logins require only the MySQL password.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/30/2026
The vulnerability identified in phpMyAdmin versions through 5.2.3 represents a critical authentication bypass flaw rooted in insufficient re-authentication requirements for sensitive configuration changes. Specifically, the application fails to verify the user's current credentials or perform a secondary challenge when modifying security-critical settings via the SetConfigController endpoint located at /config/set. This architectural oversight allows an attacker who has already obtained valid session cookies through methods such as cross-site scripting, network sniffing on unencrypted connections, or credential stuffing to manipulate server-side configuration without further proof of identity. The core technical flaw lies in the lack of a mandatory re-authentication step before executing state-changing operations that alter security policies, which violates fundamental principles of secure application design where privilege escalation or security setting modifications must require explicit user consent through password entry or multi-factor confirmation.
From an operational perspective, this vulnerability enables a severe degradation of access controls for any compromised account. By posting a JSON payload with the key set to 2fa and a null value, an authenticated attacker can effectively disable two-factor authentication on the target MySQL server instance managed by phpMyAdmin. Once two-factor authentication is stripped from the configuration, subsequent login attempts will only require the standard MySQL username and password combination. This significantly lowers the barrier for unauthorized access, as attackers no longer need to compromise a second factor such as a time-based one-time password or hardware token. The impact extends beyond simple account takeover; it potentially exposes sensitive database contents, allows data exfiltration, modification, or destruction of critical business information, and may serve as an initial foothold for lateral movement within the internal network if the MySQL server is accessible from other systems.
This vulnerability aligns with CWE-287, which describes Improper Authentication, specifically regarding the failure to enforce re-authentication for sensitive actions. It also maps closely to MITRE ATT&CK technique T1078, Valid Accounts, as it leverages existing legitimate credentials to escalate privileges or reduce security controls. Furthermore, the specific action of disabling multi-factor authentication can be categorized under T1534, Internal Spearphishing, if used in conjunction with social engineering, but more accurately fits within the broader context of Defense Evasion techniques where an attacker modifies system configurations to avoid detection and maintain persistent access without additional friction. The ability to remove 2FA effectively neutralizes a primary layer of defense against credential-based attacks, making this a high-severity issue that requires immediate attention.
Mitigation strategies must focus on both immediate remediation and long-term architectural improvements. Administrators should immediately upgrade phpMyAdmin to version 5.2.4 or later, where the SetConfigController has been patched to enforce re-authentication for any changes related to security settings including two-factor authentication configurations. In environments where upgrading is not immediately feasible, network-level controls such as Web Application Firewalls can be configured to block POST requests to /config/set that contain JSON payloads attempting to modify 2fa keys unless accompanied by a valid session token validation check or additional cryptographic proof of user intent. Additionally, implementing strict Content Security Policy headers and ensuring all administrative interfaces are served over HTTPS with HSTS enabled reduces the risk of initial session hijacking via man-in-the-middle attacks or cross-site scripting vectors that often precede this exploitation chain. Regular auditing of configuration changes within phpMyAdmin logs should also be implemented to detect any unauthorized attempts to disable security features, providing an early warning mechanism for potential compromise even if the vulnerability is not fully patched in legacy systems.