12 matches found
CVE-2026-126426
OpenEMR versions 5.0.2 before 8.5.0 are vulnerable to a missing authentication flaw in the mfa_registrations.php and mfa_u2f.php components. This allows an attacker who has hijacked a victim's authenticated session to delete existing MFA factors or register new U2F keys without providing a passwo...
SUSE CVE-2026-119429
phpMyAdmin through 5.2.3 contains a missing re-authentication vulnerability that allows authenticated attackers to remove two-factor authentication by posting the 2fa key to /config/set. Attackers holding a hijacked session can submit key=2fa with a null JSON value to SetConfigController, strippi...
CVE-2026-119429
phpMyAdmin through 5.2.3 contains a missing re-authentication vulnerability that allows authenticated attackers to remove two-factor authentication by posting the 2fa key to /config/set. Attackers holding a hijacked session can submit key=2fa with a null JSON value to SetConfigController, strippi...
CVE-2026-119429
phpMyAdmin through 5.2.3 contains a missing re-authentication vulnerability that allows authenticated attackers to remove two-factor authentication by posting the 2fa key to /config/set. Attackers holding a hijacked session can submit key=2fa with a null JSON value to SetConfigController, strippi...
CVE-2026-119429 phpMyAdmin through 5.2.3 Two-Factor Authentication Removal via /config/set
phpMyAdmin through 5.2.3 contains a missing re-authentication vulnerability that allows authenticated attackers to remove two-factor authentication by posting the 2fa key to /config/set. Attackers holding a hijacked session can submit key=2fa with a null JSON value to SetConfigController, strippi...
CVE-2026-119429
phpMyAdmin versions through 5.2.3 are vulnerable to a missing re-authentication flaw in the SetConfigController . An authenticated attacker who has hijacked a session can post key=2fa with a null JSON value to the /config/set endpoint. This action removes two-factor authentication (2FA) from the ...
EUVD-2026-113809
phpMyAdmin through 5.2.3 contains a missing re-authentication vulnerability that allows authenticated attackers to remove two-factor authentication by posting the 2fa key to /config/set. Attackers holding a hijacked session can submit key=2fa with a null JSON value to SetConfigController, strippi...
CVE-2026-119429
phpMyAdmin through 5.2.3 contains a missing re-authentication vulnerability that allows authenticated attackers to remove two-factor authentication by posting the 2fa key to /config/set. Attackers holding a hijacked session can submit key=2fa with a null JSON value to SetConfigController, strippi...
CVE-2026-119429 phpMyAdmin through 5.2.3 Two-Factor Authentication Removal via /config/set
phpMyAdmin through 5.2.3 contains a missing re-authentication vulnerability that allows authenticated attackers to remove two-factor authentication by posting the 2fa key to /config/set. Attackers holding a hijacked session can submit key=2fa with a null JSON value to SetConfigController, strippi...
CVE-2026-119429: phpMyAdmin: phpMyAdmin through 5.2.3 contains a missing re-authentication vulnerability that allows authenticated attackers to…
phpMyAdmin through 5.2.3 contains a missing re-authentication vulnerability that allows authenticated attackers to remove two-factor authentication by posting the 2fa key to /config/set. Attackers holding a hijacked session can submit key=2fa with a null JSON value to SetConfigController, strippi...
PT-2026-133482
phpMyAdmin through 5.2.3 contains a missing re-authentication vulnerability that allows authenticated attackers to remove two-factor authentication by posting the 2fa key to /config/set. Attackers holding a hijacked session can submit key=2fa with a null JSON value to SetConfigController, strippi...