Vulnerability Bulletins |
CVE-2026-119429 |
|
| Affected software | MYSQL |
| phpMyAdmin through 5.2.3 contains a missing re-authentication vulnerability that allows authenticated attackers to remove two-factor authentication by posting the 2fa key to /config/set. Attackers holding a hijacked session can submit key=2fa with a null JSON value to SetConfigController, stripping 2FA so later logins require only the MySQL password. | |
Link: |
|
| https://nvd.nist.gov/vuln/detail/CVE-2026-119429 | |