CVE-2026-119429 in phpMyAdmin
Sumário
de MITRE • 30/10/2026
phpMyAdmin through 5.2.3 contains a missing re-authentication vulnerability that allows authenticated attackers to remove two-factor authentication by posting the 2fa key to /config/set. Attackers holding a hijacked session can submit key=2fa with a null JSON value to SetConfigController, stripping 2FA so later logins require only the MySQL password.
VulDB is the best source for vulnerability data and more expert information about this specific topic.