AdminNeo CVE-2026-96629

Exploitation requires that the target run AdminNeo < 5.5.1 with its default XOR-masked CSRF token scheme (no special configuration needed - the weakness is in the default token generation/verification in functions.inc.php). The attacker must first obtain the session secret, which requires EITHER observing a single valid CSRF token through an out-of-band channel (Referrer-header leak, shared proxy logs, browser history, network sniffing, or limited XSS) and XORing its two transmitted operands, OR performing up to ~1,000,000 blind requests against the ~20-bit rand(1,1e6) session token. The attack then depends on a victim who is currently authenticated to AdminNeo being lured to visit an attacker-controlled page (UI:R), which auto-submits the forged token. Limiting factors that reduce realistic risk: an active authenticated session must exist, user interaction is required, token-observation exploitation depends on a secondary leak channel, and AdminNeo 5.5.1 adds a Sec-Fetch-Site same-origin check that blocks cross-site submission entirely.

The CVSS 3.1 vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H, base 6.8 Medium) frames this as a network-reachable, unauthenticated flaw that nonetheless requires user interaction (UI:R, a logged-in victim must visit an attacker page) and carries high attack complexity (AC:H), reflecting the precondition that the attacker first obtain a valid CSRF token or perform blind brute-force. The multi-source signals are mixed: there is a detailed, reporter-validated PoC in the GHSA advisory, but no CISA KEV listing and no EPSS score was supplied, so there is no evidence of active or widespread exploitation. The vuln.today priority Decision label is 'this_month' - a patch-promptly signal, not act_now/emergency - which is consistent with a Medium-severity, non-KEV issue. The crypto design flaw is genuinely severe in mechanism (observing a single token instantly recovers the session secret via one XOR, and the ~20-bit entropy of rand(1,1e6) makes blind brute-force feasible within ~1M requests), so the technical impact is real; however, realistic risk is tempered by the UI:R requirement and by the limited reach of a recent Adminer fork. One conflict worth flagging: the vendor scored C:N (no confidentiality impact), yet the description claims attackers can 'exfiltrate data' - this is defensible because CSRF responses are blocked by the same-origin policy, but a CSRF-created backdoor DB user would grant full follow-on read access, so the practical confidentiality exposure is higher than C:N alone suggests. Net: a real, worth-patching issue, not a drop-everything emergency on current signals.

An attacker obtains one valid AdminNeo CSRF token - via a Referrer-header leak, shared proxy/browser-history logs, network sniffing, or limited XSS - and recovers the session secret with a single XOR because the token transmits both the mask and the masked value. The attacker then lures an authenticated AdminNeo user to a malicious web page that auto-submits a forged token executing arbitrary SQL (e.g. creating a backdoor database user). A detailed PoC exists in the GHSA advisory, reported as validated against a live AdminNeo 5.5.0 instance; the ~20-bit session entropy also permits blind brute-force (~1M requests) with no observed token at all.