CVE-2026-119429

phpMyAdmin versions through 5.2.3 are vulnerable to a missing re-authentication flaw in the SetConfigController . An authenticated attacker who has hijacked a session can post key=2fa with a null JSON value to the /config/set endpoint. This action removes two-factor authentication (2FA) from the ...