Security: phpMyAdmin 5.2.3: WebAuthn Two-Factor Authentication Bypass

October 28, 2026 16:09
Updated

Situation

There are reports of a two-factor authentication (2FA) bypass in phpMyAdmin 5.2.3. It affects WebAuthn (security key) 2FA in installations that do not include the web-auth/webauthn-lib library.

Affected product version

Product	Affected versions	Patched versions
cPanel & WHM	Not affected	Not applicable

Impact

None to cPanel & WHM servers.

The phpMyAdmin provided with cPanel & WHM includes the web-auth/webauthn-lib library, so the vulnerable condition is not present. In addition, phpMyAdmin is only available after you log in to cPanel or WHM, where the cPanel & WHM two-factor authentication applies.

Call to action

None at this time, as cPanel & WHM is not affected by this vulnerability.