EUVD-2026-46070
GHSA-hvv2-8jpj-gr8h
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
AC:H reflects the mandatory misconfigured reverse proxy precondition; UI:R because a victim authenticated user must navigate to a malicious page; no confidentiality scope change beyond the Adminer application itself.
Primary rating from Vendor (vulncheck).
CVSS VectorVendor: vulncheck
Lifecycle Timeline
2DescriptionCVE.org
Adminer before 5.4.3 contains a cookie injection vulnerability that allows attackers to manipulate cookie attributes by injecting arbitrary values through the unsanitized X-Forwarded-Prefix HTTP header used in Set-Cookie path attributes. Attackers can exploit a misconfigured reverse proxy to downgrade SameSite protection and enable cross-origin authenticated requests, bypassing cookie security controls.
AnalysisAI
Cookie injection in Adminer before 5.4.3 allows network-accessible, unauthenticated attackers to manipulate Set-Cookie path attributes by injecting arbitrary values through the unsanitized X-Forwarded-Prefix HTTP header, enabling downgrade of SameSite protection and subsequent cross-origin authenticated requests against victim sessions. Exploitation is gated on a misconfigured reverse proxy that forwards attacker-controlled header values and requires passive user interaction (UI:P per CVSS 4.0), making this a realistic but non-trivial attack path. No active exploitation confirmed (not in CISA KEV) and no public exploit code identified at time of analysis; vendor-released patch is available as version 5.4.3.
Technical ContextAI
Adminer is a widely-used single-file PHP database management interface supporting MySQL, PostgreSQL, SQLite, and other backends. The root cause is CWE-113 (Improper Neutralization of CRLF Sequences in HTTP Headers), a class of header injection vulnerabilities where attacker-controlled input is embedded unsanitized into HTTP response headers. Specifically, Adminer consumed the X-Forwarded-Prefix header - commonly set by reverse proxies such as Nginx or Traefik to communicate a path prefix - and embedded its value directly into the Set-Cookie path attribute without sanitization. An attacker who can inject arbitrary values into this header can inject additional cookie attributes (e.g., SameSite=None; Secure=false) or terminate and reopen cookie directives, effectively stripping or downgrading SameSite protections that normally block cross-site request forgery vectors. No CPE strings were provided in the input, but the affected software is identifiable as vrana/adminer on GitHub, versions prior to 5.4.3.
RemediationAI
Upgrade to Adminer 5.4.3 or later, which sanitizes the X-Forwarded-Prefix header value before embedding it in Set-Cookie path attributes. The patched release is available at https://github.com/vrana/adminer/releases#release-v5.4.3 and the advisory at https://github.com/vrana/adminer/security/advisories/GHSA-c533-9qwm-8w5h. For deployments unable to upgrade immediately, configure the reverse proxy (e.g., Nginx, Traefik, Apache mod_proxy) to explicitly strip or block the X-Forwarded-Prefix header before requests reach the Adminer instance - this removes the attacker-controlled injection vector entirely and has no functional downside for most setups unless Adminer relies on path prefix detection. As a defense-in-depth measure, restrict Adminer access to trusted internal networks or VPN endpoints, which eliminates external attacker reachability regardless of the header handling behavior.
Same weakness CWE-113 – HTTP Response Splitting
View allSame technique Authentication Bypass
View allVendor StatusVendor
SUSE
Severity: ImportantShare
External POC / Exploit Code
Leaving vuln.today