CVE-2026-16434: Adminer before 5.5.1 X-Forwarded-Prefix Backslash Bypass
Adminer 4.6.0 through 5.5.0 (fixed in 5.5.1) contains an incomplete fix for a prior X-Forwarded-Prefix vulnerability (GHSA-8478-xrj3-h9c2). The validation guard (bootstrap.inc.php) only rejects prefixes matching ^/[^/], blocking //evil.com but allowing values such as /\evil.com whose second character is a backslash. Because browsers normalize backslash to forward slash, a network-path reference survives into REQUESTURI and reaches cookiepath(), affecting the Set-Cookie Path attribute. Exploitation requires that clients can set the X-Forwarded-Prefix header (a misconfigured or absent reverse proxy). Impact is limited to anomalous cookie-path scoping.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Adminerto a version that resolves this vulnerability.Fixed in 5.5.1 - Configuration
Update the X-Forwarded-Prefix validation to block backslash-based bypasses (the current guard only rejects prefixes matching ^/[^/], which still allows values such as /\evil.com).
bootstrap.inc.php (validation guard) X-Forwarded-Prefix prefix validation = reject values where the second character is a backslash (\\) (i.e., fail validation for prefixes like /\evil.com) - Compensating control
Ensure clients cannot set the X-Forwarded-Prefix header directly; only a correctly configured reverse proxy/CDN should be allowed to add X-Forwarded-Prefix (e.g., strip/ignore any inbound X-Forwarded-Prefix and set it at the proxy).
Event History
Frequently Asked Questions
Which deployments are realistically exposed?
Adminer versions 4.6.0 through 5.5.0 are affected when clients can supply the X-Forwarded-Prefix header. This typically requires an absent or misconfigured reverse proxy that does not remove or control that header.
What must an attacker do to exploit the issue?
The attacker needs to send an X-Forwarded-Prefix value containing a backslash-based network-path reference, such as /\evil.com. Browser normalization converts the backslash to a forward slash, allowing the value to influence the Set-Cookie Path attribute.
What is the impact of successful exploitation?
The impact is limited to anomalous cookie-path scoping through the Set-Cookie Path attribute. The provided CVSS vector indicates no confidentiality or availability impact and low integrity impact.
What can be done before upgrading?
Ensure that clients cannot set X-Forwarded-Prefix directly. Configure the reverse proxy to strip untrusted instances of the header or set it only to a validated value.
How can I determine whether my deployment is affected?
Check whether Adminer is running a version from 4.6.0 through 5.5.0 and whether a client-controlled X-Forwarded-Prefix header reaches Adminer. A deployment that rejects, strips, or overwrites untrusted X-Forwarded-Prefix values is not exposed through the described condition.