Is CVE-2026-119429 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-119429 being exploited in the wild.

How severe is CVE-2026-119429?

Medium severity, with a CVSS score of 4.3, published 30 October 2026.

Is there a fix for CVE-2026-119429?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-119429 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-119429?

Check whether you run phpMyAdmin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-119429: phpMyAdmin missing re-authentication in config preference removal

CVE-2026-119429 · Severity: medium · CVSS 4.3 · Published 2026-10-30

phpMyAdmin is a web interface used by administrators to manage MySQL and MariaDB databases. An attacker with access to a logged-in user's session can permanently disable two-factor authentication without requiring the user to verify their identity, allowing subsequent logins with only a password. This vulnerability affects phpMyAdmin through version 5.2.3 and could lead to unauthorized database access if an attacker gains temporary session control.

Technologies: phpMyAdmin. Vendors: phpMyAdmin.

Quick answers

Is CVE-2026-119429 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-119429 being exploited in the wild.
How severe is CVE-2026-119429?: Medium severity, with a CVSS score of 4.3, published 30 October 2026.
Which products and versions are affected?: phpMyAdmin through 5.2.3.
Is there a fix for CVE-2026-119429?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-119429 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-119429?: Check whether you run phpMyAdmin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in the SetConfigController's /config/set endpoint, which writes user preferences including the 2fa setting without requiring re-authentication via TwoFactor::check(true). An authenticated attacker can POST key=2fa with a null JSON value to permanently remove the stored 2FA configuration from the pmadb database, bypassing the durable protection offered by the normal Settings interface which does enforce factor verification. This allows attackers holding a hijacked session to strip 2FA and gain persistent unauthorized access to the database after the legitimate user's next login.

Affected products

phpMyAdmin phpMyAdmin through 5.2.3

Timeline

2026-10-30: disclosed: CVE-2026-119429 published
2026-10-12: other: Vulnerability initially researched and publicly disclosed by Abraxas Labs

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.