phpMyAdmin through version 5.2.3 allows an attacker who already has valid MySQL credentials to bypass the WebAuthn two‑factor verification process. The vulnerability arises because the CustomServer::parseAndValidateAssertionResponse() method does not check the signature of the WebAuthn assertion against the stored public key, so a crafted webauthn_request_response that matches the challenge, origin, and rpIdHash is accepted without proper authentication. This flaw delivers a classic authentication bypass (CWE‑347) and could enable an attacker to obtain full database privileges without performing the intended second‑factor check.

The flaw affects all installations of phpMyAdmin up to and including version 5.2.3 that have the WebAuthn two‑factor authentication feature enabled. Any server hosting phpMyAdmin with this feature, regardless of deployment scale, is potentially vulnerable if the attacker can post to the custom server endpoint.

The CVSS score of 7.6 classifies this issue as high severity. No EPSS score is available and the vulnerability is not listed in CISA’s KEV catalog, suggesting that widespread exploitation has not been documented yet. However, once an attacker has valid MySQL credentials and can submit the POST request, the absence of signature verification allows a straightforward bypass of the second factor, significantly increasing the risk for systems relying on WebAuthn for enhanced security.