CVE-2026-119561 in phpMyAdmin
Summary
by MITRE • 10/30/2026
phpMyAdmin through 5.2.3 contains an authentication bypass vulnerability in CustomServer::parseAndValidateAssertionResponse() that never verifies WebAuthn assertion signatures against stored public keys. Attackers holding a victim's MySQL credentials can POST a crafted webauthn_request_response with matching challenge, origin, and rpIdHash to bypass the second factor and gain database privileges.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/30/2026
The vulnerability identified in phpMyAdmin versions through 5.2.3 represents a critical authentication bypass flaw within the CustomServer::parseAndValidateAssertionResponse() function. This specific component is responsible for handling WebAuthn assertions, which are part of the second-factor authentication process designed to enhance security beyond standard username and password combinations. The core technical deficiency lies in the failure to verify that the cryptographic signature contained within a WebAuthn assertion corresponds to the public key previously registered and stored by the system for the specific user account being accessed. In a properly implemented WebAuthn flow, the server must use the stored public key to validate the digital signature generated by the authenticator using its private key. By omitting this verification step, phpMyAdmin effectively treats any assertion that matches the expected challenge, origin, and rpIdHash as valid, regardless of whether it was signed by the legitimate user's hardware security key or software token.
This architectural oversight allows an attacker who has obtained a victim's MySQL credentials through phishing, credential stuffing, or other means to bypass the second factor entirely. The attack vector involves posting a crafted webauthn_request_response payload that satisfies the structural requirements of the protocol but lacks cryptographic validity relative to the user's actual registered keys. Since the server does not check if the signature was created by the correct private key associated with the stored public key, it accepts the authentication attempt as successful. This results in unauthorized access to the database management interface, granting the attacker full privileges equivalent to those of the compromised account. The severity is compounded by the fact that WebAuthn is often deployed specifically because it provides strong phishing resistance and secure multi-factor authentication; bypassing this mechanism undermines a primary security control intended to protect sensitive data repositories.
From an industry standards perspective, this vulnerability aligns with CWE-287, which describes Improper Authentication, as well as CWE-345, Insufficient Verification of Data Authenticity. The failure to validate the cryptographic signature against stored credentials is a classic example of trusting input without verifying its origin or integrity in a security-critical context. In terms of the MITRE ATT&CK framework, this behavior facilitates Initial Access via Valid Accounts and specifically exploits weaknesses in Multi-Factor Authentication mechanisms. Attackers can leverage this flaw to escalate from simple credential theft to full system compromise without needing physical access to the victim's authenticator device or possession of its private key material.
The operational impact of this vulnerability is severe for organizations relying on phpMyAdmin as their primary interface for MySQL database management. Unauthorized access allows attackers to read, modify, delete, or exfiltrate sensitive data stored within the databases managed by phpMyAdmin. Furthermore, depending on the privileges granted to the compromised account, an attacker might execute arbitrary SQL commands that could lead to server-side request forgery, remote code execution via specific MySQL features like LOAD_FILE, or lateral movement across networked systems if database credentials are reused elsewhere. The ease of exploitation means that automated scanning tools can rapidly identify and exploit this weakness in exposed phpMyAdmin instances, leading to widespread compromise incidents among unpatched deployments.
Mitigation strategies must prioritize immediate patching to the latest version of phpMyAdmin where this validation logic has been corrected. Until an update is applied, administrators should consider restricting access to phpMyAdmin through network-level controls such as IP whitelisting or reverse proxy configurations that enforce additional authentication layers like OAuth2 or SAML before reaching the application layer. Additionally, disabling WebAuthn support if it is not strictly required can reduce the attack surface, although this may impact usability for legitimate users who rely on hardware keys. Security monitoring should be enhanced to detect unusual login patterns, particularly those involving successful second-factor authentications that do not correlate with known device fingerprints or geographic locations associated with the user account. Regular audits of authentication logs and implementation of strict access control policies are essential to minimize the risk posed by such vulnerabilities in database administration tools.