phpMyAdmin 5.2.3 hit by CVSS 8.1 2FA bypass: WebAuthn signatures never COSE-verified

cyb3rops · x · 2026-10-29

Security researcher abraxas disclosed a high-severity 2FA bypass in phpMyAdmin 5.2.3 (CVSS 8.1, CWE-347/287) with a public PoC and vendor email.

• Root cause: the distributed tarball is built with composer install --no-dev, and web-auth/webauthn-lib is only a dev/suggest dependency, so WebAuthn::createServer instantiates a custom CustomServer instead of the WebAuthn library implementation.
• Impact: CustomServer::parseAndValidateAssertionResponse only performs structural checks (clientData type, session challenge, origin, rpIdHash, user-present) and never COSE-verifies the signature against the stored credentialPublicKey — arbitrary bytes pass.
• Exploit: after authenticating with the MySQL password, an attacker submits a forged but structurally valid WebAuthn assertion via authenticated POST /index.php to bypass 2FA.

Original post →

More from Safety

• Machine Gods pod: Anthropic S-1 breakdown plus Signal president's warning on agents vs privacy — kevinroose · 2026-10-29
• Ex-OpenAI Researcher's 26,000-Word Post Says Neural Networks May Not Be Black Boxes — CurieuxExplorer · 2026-10-29
• Anthropic's GRAFT fights reward hacking by deleting parameters, not penalizing behavior — dl_weekly · 2026-10-29
• TMLR Reviewers Quit Over Aggressive Desk Rejections Amid Rising AI Slop — miniapeur · 2026-10-29
• 3-person security startup accessed all of Anthropic's research secrets in 12 hours — willdepue · 2026-10-29
• New amicus brief in OpenAI MDL argues AI helps journalists build their brand — TuhinChakr · 2026-10-29

Safety channel →