phpMyAdmin versions up to 5.2.3 have an authentication bypass vulnerability in the CustomServer::parseAndValidateAssertionResponse() function. This flaw occurs because the function does not verify WebAuthn assertion signatures against stored public keys. An attacker with valid MySQL credentials can exploit this by sending a crafted webauthn_request_response with matching challenge, origin, and rpIdHash to bypass the second factor authentication and gain database privileges.