The vulnerability lies in phpMyAdmin’s earlier versions up to 5.2.3, where an authenticated user can bypass the two‑factor authentication requirement. By posting a specially crafted request to /config/set with the key parameter set to 2fa and a null JSON value, the attacker can remove the 2FA setting from the configuration. When 2FA is disabled, subsequent logins only require the MySQL password, thereby permitting an attacker who already holds a hijacked session to gain persistent access to the database backend. This flaw is categorized as CWE‑620.

The flaw affects phpMyAdmin up to and including version 5.2.3. The product is available from the phpMyAdmin project, and any installation that has not upgraded past 5.2.3 is susceptible.

The CVSS base score of 5.3 indicates a medium‑severity vulnerability. Exploitation requires the attacker to already possess an authenticated session, which can occur commonly after session hijacking or credential compromise. Because the attack vector is local to a web session, the EPSS score is not provided. The flaw is not listed in the CISA KEV catalog, but the lack of re‑authentication may still yield significant risk if an attacker can hijack a session. Immediate remediation is advised before attackers obtain persistent access.