Security: phpMyAdmin 5.2.3 WebAuthn Two-Factor Authentication Bypass

Situation

There are reports of a two-factor authentication (2FA) bypass in phpMyAdmin 5.2.3. It affects WebAuthn (security key) 2FA in installations that do not include the web-auth/webauthn-lib library.

Impact

None to Plesk servers.

This affects phpMyAdmin's own two-factor authentication when the web-auth/webauthn-lib library is missing. The phpMyAdmin provided with Plesk includes this library on both Linux and Windows, so the vulnerable condition is not present. In addition, by default phpMyAdmin is only available after you log in to Plesk, where Plesk's own two-factor authentication applies.

Call to action

None at this time, as Plesk is not affected by this vulnerability.