phpMyAdmin through 5.2.3 contains an authentication bypass vulnerability in CustomServer::parseAndValidateAssertionResponse() that never verifies WebAuthn assertion signatures against stored public keys. Attackers holding a victim's MySQL credentials can POST a crafted webauthn_request_response with matching challenge, origin, and rpIdHash to bypass the second factor and gain database privileges.
Fix
Nothing published yet: no patch, vendor advisory or mitigation reference on NVD, no vendor advisory in the News for this CVE, not in CISA's KEV, no fixed package version. BaselineWatch does not guess at one.
Change history 1
- First seenCVSS 7.6 · phpmyadminNVD modified 2026-10-30 11:31
Affected (CPE criteria) 0
NVD has not attached CPE configurations yet.
References 5
- https://github.com/phpmyadmin/phpmyadmin/blob/RELEASE_5_2_3/libraries/classes/WebAuthn/CustomServer.php#L76-L110 technical-description
- https://abraxaslabs.tech/research/PMA-5.2.3-WebAuthn-2FA third-party-advisory
- https://abraxaslabs.tech/research/phpmyadmin-webauthn third-party-advisory
- https://github.com/phpmyadmin/phpmyadmin product
- https://www.vulncheck.com/advisories/phpmyadmin-through-5.2.3-webauthn-two-factor-authentication-bypass-via-customserver third-party-advisory