Is CVE-2026-119429 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-119429?

CVE-2026-119429 has a CVSS v3 severity of MEDIUM (4.3).

Back

CVE-2026-119429

Description

phpMyAdmin through 5.2.3 contains a missing re-authentication vulnerability that allows authenticated attackers to remove two-factor authentication by posting the 2fa key to /config/set. Attackers holding a hijacked session can submit key=2fa with a null JSON value to SetConfigController, stripping 2FA so later logins require only the MySQL password.