phpMyAdmin CVE-2026-119561

Exploitation requires three concrete conditions: (1) the attacker already possesses the victim's valid first-factor MySQL username and password (reflected as PR:L); (2) the targeted account has WebAuthn/FIDO2 configured as its phpMyAdmin second factor, which is an opt-in, non-default configuration; and (3) the attacker POSTs a crafted webauthn_request_response containing a challenge, origin, and rpIdHash matching the server's values. The core defect is that parseAndValidateAssertionResponse() never verifies the assertion signature against the stored public key, so any response with matching metadata is accepted. Limiting factors that reduce real-world risk: valid first-factor credentials are mandatory (this is a 2FA bypass, not a standalone login bypass), only accounts that enabled WebAuthn 2FA are affected, and the attacker needs network access to the phpMyAdmin interface. The AC:H/AT:P metrics reflect the need to assemble a response with the correct matching challenge/origin/rpIdHash values.

Signals are moderate and partially conflicting. The CVSS 4.0 vector (AV:N but AC:H/AT:P and PR:L) scores 7.6 High, and the vuln.today Decision label is 'this_week' rather than act_now/emergency. No EPSS score is provided and there is no CISA KEV listing, so there is no evidence of widespread or active exploitation. The flaw is a genuine signature-verification failure (CWE-347) in phpMyAdmin's WebAuthn second factor, but its real-world leverage is gated: an attacker must ALREADY hold the victim's valid MySQL credentials (PR:L), and the target account must have WebAuthn 2FA configured - a non-default, opt-in feature. Thus this is a targeted, second-stage bypass that neutralizes 2FA after first-factor compromise, not a mass-exploitable remote-code path. Technical research is publicly documented by VulnCheck and abraxaslabs, raising the practical likelihood that working exploit code will appear, but no confirmed weaponized exploit is listed in the input. Net: a real priority for environments that rely on phpMyAdmin WebAuthn 2FA to protect shared/stolen MySQL credentials, but lower urgency where 2FA is not enabled. EPSS/KEV are both absent, so the 'this_week' label - not exploitation telemetry - is the strongest urgency signal available.

An attacker who has phished, reused, or otherwise obtained a victim's valid MySQL credentials reaches phpMyAdmin's WebAuthn second-factor prompt and submits a forged webauthn_request_response carrying the expected challenge, origin, and rpIdHash. Because CustomServer::parseAndValidateAssertionResponse() never checks the assertion signature against the stored public key, the crafted response is accepted and the attacker gains full database privileges, defeating the 2FA entirely. Public technical analysis exists from VulnCheck and abraxaslabs, though the input does not confirm working exploit code.