Security: phpMyAdmin 5.2.3 WebAuthn Two-Factor Authentication Bypass
Reports of a two-factor authentication bypass in phpMyAdmin 5.2.3 affect only installations where the web-auth/webauthn-lib library is missing — and Plesk's bundled phpMyAdmin includes that library on both Linux and Windows. Plesk has confirmed the vulnerable condition is not present on Plesk servers, so no action is required beyond keeping Plesk updated as usual.
प्रभावित संस्करण
5.2.3
डिफ़ॉल्ट अपडेट कमांड
plesk installer --select-release-current --update-installedSharedLicense लाइसेंस के तहत इसका अर्थ
Where the library is missing, the bypass defeats phpMyAdmin's WebAuthn second factor — an attacker with a stolen database-user password could log in without the security key. Plesk servers are not exposed.
Situation
There are reports of a two-factor authentication (2FA) bypass in phpMyAdmin 5.2.3. It affects WebAuthn (security key) 2FA in installations that do not include the web-auth/webauthn-lib library.
Impact
None to Plesk servers.
This affects phpMyAdmin’s own two-factor authentication when the web-auth/webauthn-lib library is missing. The phpMyAdmin provided with Plesk includes this library on both Linux and Windows, so the vulnerable condition is not present. In addition, by default phpMyAdmin is only available after you log in to Plesk, where Plesk’s own two-factor authentication applies.
Call to action
None at this time, as Plesk is not affected by this vulnerability.
अक्सर पूछे जाने वाले प्रश्न
What is the phpMyAdmin 5.2.3 WebAuthn bypass?
Are Plesk servers affected by this bypass?
Do I need to update anything on Plesk?
How can I check my own standalone phpMyAdmin?
संदर्भ
अपने सिस्टम में भेद्यताओं की जाँच करें
अपना उत्पाद और ऑपरेटिंग सिस्टम चुनें ताकि आपके लिए लागू सटीक फिक्स कमांड देख सकें।
अपना सिस्टम जाँचें