# CVE-2026-119561: phpMyAdmin WebAuthn signature verification bypass in CustomServer

Source: https://junglewise.ai/threats/cve-2026-119561-phpmyadmin-through-5-2-3-contains-an-authentication-bypass  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-119561 · Severity: medium · CVSS 6.8 · Published 2026-10-30

phpMyAdmin is a web application that lets administrators manage MySQL databases through a browser interface. This vulnerability affects the optional two-factor authentication feature: an attacker who has already obtained a victim's MySQL login credentials can bypass the WebAuthn second factor by submitting a forged authentication response with a fake signature. This grants complete access to the database.

Technologies: [phpMyAdmin](https://junglewise.ai/threats/technologies/phpmyadmin). Vendors: [phpMyAdmin](https://junglewise.ai/threats/vendors/phpmyadmin).

## Quick answers

**Is CVE-2026-119561 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-119561 being exploited in the wild.

**How severe is CVE-2026-119561?** Medium severity, with a CVSS score of 6.8, published 30 October 2026.

**Which products and versions are affected?** phpMyAdmin 5.2.3 (default tarball without web-auth/webauthn-lib).

**Is there a fix for CVE-2026-119561?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-119561 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-119561?** Check whether you run phpMyAdmin at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability exists in phpMyAdmin 5.2.3's CustomServer::parseAndValidateAssertionResponse() method, which validates WebAuthn assertions but never verifies the cryptographic signature against stored public keys. An attacker with valid MySQL credentials can POST a crafted webauthn_request_response containing a matching challenge, origin, rpIdHash, and user-present flag but with an invalid or fake signature to bypass 2FA. This occurs only when the optional web-auth/webauthn-lib dependency is not installed; installations with that library use WebauthnLibServer instead and are not affected.

## Affected products

- phpMyAdmin phpMyAdmin 5.2.3 (default tarball without web-auth/webauthn-lib)

## Timeline

- 2026-09-20: disclosed
- 2026-10-30: advisory
- 2026-10-30: other: Published with CVE-2026-119561

## References

- [https://abraxaslabs.tech/research/PMA-5.2.3-WebAuthn-2FA](https://abraxaslabs.tech/research/PMA-5.2.3-WebAuthn-2FA)
- [https://abraxaslabs.tech/research/phpmyadmin-webauthn](https://abraxaslabs.tech/research/phpmyadmin-webauthn)

## Related threats

- [phpMyAdmin stored cross-site scripting in Designer history](https://junglewise.ai/threats/cve-2026-119563-phpmyadmin-through-5-2-3-contains-a-stored-cross-site-scripting)
- [phpMyAdmin SQL injection in central columns](https://junglewise.ai/threats/cve-2026-119562-phpmyadmin-through-5-2-3-contains-an-sql-injection-vulnerability)
- [phpMyAdmin missing re-authentication in config preference removal](https://junglewise.ai/threats/cve-2026-119429-phpmyadmin-through-5-2-3-contains-a-missing-re-authentication)
- [phpMyAdmin SQL injection in Designer saveSetting()](https://junglewise.ai/threats/cve-2026-119427-phpmyadmin-through-5-2-3-contains-an-sql-injection-vulnerability)
- [phpMyAdmin CSRF token bypass allows SQL execution](https://junglewise.ai/threats/cve-2026-119426-phpmyadmin-through-5-2-3-contains-a-cross-site-request-forgery)