-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| phpmyadmin/phpmyadmin | composer | >= 4.3.0, < 4.3.13.2 | 4.3.13.2 |
| phpmyadmin/phpmyadmin | composer | >= 4.4.0, < 4.4.14.1 | 4.4.14.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from session-based reCaptcha bypass logic removed in the patches (785f4e2/0314e67). Both auth() and authCheck() checked $_SESSION['last_valid_captcha'] to skip captcha validation. The removal of these checks in the patch directly correlates with the described vulnerability where a single valid captcha response could bypass subsequent challenges. The file path and function names are explicitly shown in the commit diffs, confirming their involvement.