Güvenlik Danışarlıklarına Dön

Security: phpMyAdmin 5.2.3 WebAuthn Two-Factor Authentication Bypass

Reports of a two-factor authentication bypass in phpMyAdmin 5.2.3 affect only installations where the web-auth/webauthn-lib library is missing — and Plesk's bundled phpMyAdmin includes that library on both Linux and Windows. Plesk has confirmed the vulnerable condition is not present on Plesk servers, so no action is required beyond keeping Plesk updated as usual.

High
Plesk

Etkilenen Sürümler

5.2.3

Varsayılan Güncelleme Komutu

plesk installer --select-release-current --update-installed

SharedLicense lisansı altında bunun anlamı

Where the library is missing, the bypass defeats phpMyAdmin's WebAuthn second factor — an attacker with a stolen database-user password could log in without the security key. Plesk servers are not exposed.

Situation

There are reports of a two-factor authentication (2FA) bypass in phpMyAdmin 5.2.3. It affects WebAuthn (security key) 2FA in installations that do not include the web-auth/webauthn-lib library.

Impact

None to Plesk servers.

This affects phpMyAdmin’s own two-factor authentication when the web-auth/webauthn-lib library is missing. The phpMyAdmin provided with Plesk includes this library on both Linux and Windows, so the vulnerable condition is not present. In addition, by default phpMyAdmin is only available after you log in to Plesk, where Plesk’s own two-factor authentication applies.

Call to action

None at this time, as Plesk is not affected by this vulnerability.

Sıkça Sorulan Sorular

What is the phpMyAdmin 5.2.3 WebAuthn bypass?
It is a reported two-factor authentication bypass in phpMyAdmin 5.2.3 that affects WebAuthn (security key) 2FA in installations missing the web-auth/webauthn-lib library. Without that library, phpMyAdmin's own 2FA can be bypassed by an attacker who already has valid database credentials.
Are Plesk servers affected by this bypass?
No — Plesk confirms the phpMyAdmin provided with Plesk includes the web-auth/webauthn-lib library on both Linux and Windows, so the vulnerable condition is not present. Plesk rates the impact to Plesk servers as none.
Do I need to update anything on Plesk?
No action is required for this specific issue — keep Plesk updated via the normal panel updater as usual. If you run a separate, standalone phpMyAdmin outside Plesk, check whether it includes the web-auth/webauthn-lib library and update phpMyAdmin if it does not.
How can I check my own standalone phpMyAdmin?
Verify the web-auth/webauthn-lib library is present in your phpMyAdmin's vendor directory, confirm 2FA still prompts for the security key on login, and update phpMyAdmin to the latest release — the upstream project addressed the bypass condition in current versions.

Referanslar

Güvenlik Danışarlıkları

İlgili Danışarlıklar

Vulnerability CVE-2026-113386: IMAP command injection in Roundcube in Plesk

2026-10-20

Vulnerability CVE-2026-107663 in WP Toolkit on cPanel & WHM

2026-10-13

Plesk CVE-2026-68492: Untrusted Search Path

2026-09-23 00:00:00

Sisteminizi güvenlik açıkları açısından kontrol edin

Size uygun tam düzeltme komutlarını görmek için ürününüzü ve işletim sisteminizi seçin.

Sisteminizi Kontrol Edin