| Package | Affected versions | Patched versions |
|---|---|---|
| phpmyadmin | ≤ 5.2.3 |
phpMyAdmin through 5.2.3 contains a missing re-authentication vulnerability that allows authenticated attackers to remove two-factor authentication by posting the 2fa key to /config/set. Attackers holding a hijacked session can submit key=2fa with a null JSON value to SetConfigController, stripping 2FA so later logins require only the MySQL password.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free