PT-2026-133499
CVE-2026-119561
·
Published
2026-10-30
·
Updated
2026-10-30
Description by
CVSS 3.1
6.8
MediumMetricsAV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
phpMyAdmin through 5.2.3 contains an authentication bypass vulnerability in CustomServer::parseAndValidateAssertionResponse() that never verifies WebAuthn assertion signatures against stored public keys. Attackers holding a victim's MySQL credentials can POST a crafted webauthn request response with matching challenge, origin, and rpIdHash to bypass the second factor and gain database privileges.
Found an issue in the description? Have something to add? Feel free to write us 👾