CVE-2026-119429mediumCWE-620

CVE-2026-119429: falha de média gravidade em phpMyAdmin

phpMyAdmin through 5.2.3 Two-Factor Authentication Removal via /config/set

Publicada em

Seguir esta CVE+ Monitorar phpMyAdmin+ Monitorar phpmyadmin

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.3epss 0.4%
phpMyAdmin through 5.2.3 contains a missing re-authentication vulnerability that allows authenticated attackers to remove two-factor authentication by posting the 2fa key to /config/set. Attackers holding a hijacked session can submit key=2fa with a null JSON value to SetConfigController, stripping 2FA so later logins require only the MySQL password.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Produtos afetados
phpMyAdmin · phpMyAdmin
CVEs relacionadas — phpMyAdmin

No mesmo produto, das mais perigosas para as menos.

CVE-2022-0813MEDIUMPhpMyAdmin exposure of sensitive informationEPSS 1.3%CVE-2025-24530MEDIUMCVE-2025-24530EPSS 0.4%CVE-2025-24529MEDIUMCVE-2025-24529EPSS 0.4%CVE-2026-119426HIGHphpMyAdmin through 5.2.3 CSRF Token Bypass via Non-AJAX POST to /sqlEPSS 0.4%CVE-2026-119428MEDIUMphpMyAdmin through 5.2.3 SSRF via setup/validate.php After Setup DisabledEPSS 0.3%CVE-2026-119427LOWphpMyAdmin through 5.2.3 SQL Injection via Designer saveSettingEPSS 0.3%