CVE-2026-119429
Medium · 4.3CVSS
4.3
EPSS
—
Published
Oct 30, 2026
CISA due date
—
The record
phpMyAdmin through 5.2.3 contains a missing re-authentication vulnerability that allows authenticated attackers to remove two-factor authentication by posting the 2fa key to /config/set. Attackers holding a hijacked session can submit key=2fa with a null JSON value to SetConfigController, stripping 2FA so later logins require only the MySQL password.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-118984 OmniRoute 3.8.0 before 3.8.52 contains an unverified password change vulnerability that… CWE-620
- CVE-2013-20008 Linksys WAG200G through 1.01.06 contains a weak password change mechanism that allows… CWE-620
- CVE-2026-97380 MariaDB server is a community developed fork of MySQL server. CWE-620
- CVE-2026-85591 phpMyFAQ versions before 4.1.8 contain an authentication bypass vulnerability in the user… CWE-620
- CVE-2026-77644 A critical bypass access control vulnerability has been reported in PTC Windchill Risk… CWE-620
- CVE-2026-73292 Semaphore UI is a web interface for managing DevOps tools. CWE-620
- CVE-2026-17599 Nexus Repository 3 contained an endpoint used to change the administrator account… CWE-620
- CVE-2026-12692 Unverified password change vulnerability in Vimesoft Inc. CWE-620