CVE-2016-6606

An issue was discovered in cookie encryption in phpMyAdmin. The decryption of the username/password is vulnerable to a padding oracle attack. This can allow an attacker who has access to a user's browser cookie file to decrypt the username and password. Furthermore, the same initialization vector (IV) is used to hash the username and password stored in the phpMyAdmin cookie. If a user has the same password as their username, an attacker who examines the browser cookie can see that they are the same - but the attacker can not directly decode these values from the cookie as it is still hashed. All 4.6.x versions (prior to 4.6.4), 4.4.x versions (prior to 4.4.15.8), and 4.0.x versions (prior to 4.0.10.17) are affected.

• CWE-200
• CWE-310

• http://www.securityfocus.com/bid/94114Third Party Advisory, VDB Entry
• https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html
• https://security.gentoo.org/glsa/201701-32
• https://www.phpmyadmin.net/security/PMASA-2016-29Patch, Vendor Advisory
• http://www.securityfocus.com/bid/94114Third Party Advisory, VDB Entry
• https://lists.debian.org/debian-lts-announce/2019/06/msg00009.html
• https://security.gentoo.org/glsa/201701-32
• https://www.phpmyadmin.net/security/PMASA-2016-29Patch, Vendor Advisory

Published

Dec 11, 2016

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-6600Directory traversal vulnerability in the file upload functio…
• CVE-2016-6601Directory traversal vulnerability in the file download funct…
• CVE-2016-6602ZOHO WebNMS Framework 5.2 and 5.2 SP1 use a weak obfuscation…
• CVE-2016-6603ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attacker…
• CVE-2016-6604NULL pointer dereference in Samsung Exynos fimg2d driver for…
• CVE-2016-6605Impala in CDH 5.2.0 through 5.7.2 and 5.8.0 allows remote at…
• CVE-2016-6607XSS issues were discovered in phpMyAdmin. This affects Zoom …
• CVE-2016-6608XSS issues were discovered in phpMyAdmin. This affects the d…
• CVE-2016-6609An issue was discovered in phpMyAdmin. A specially crafted d…
• CVE-2016-6610A full path disclosure vulnerability was discovered in phpMy…
• CVE-2016-6611An issue was discovered in phpMyAdmin. A specially crafted d…
• CVE-2016-6612An issue was discovered in phpMyAdmin. A user can exploit th…