CVE-2026-34959: Adminer before 5.5.0 Open Redirect via X-Forwarded-Prefix
Adminer 4.6.0 before 5.5.0 prepends the client-supplied X-Forwarded-Prefix header to $SERVER["REQUESTURI"] with no trusted-proxy check and no validation of the prefix value. An attacker can supply an absolute URL (e.g. X-Forwarded-Prefix: https://evil.example) that flows into Location redirect headers, the Set-Cookie path attribute, and self-referential links. This enables an authenticated open redirect after state-changing POSTs, unauthenticated control of the session cookie path attribute, and poisoning of self-referential links; CR/LF cannot be injected, so header splitting/XSS is not possible.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Adminerto a version that resolves this vulnerability.Fixed in 5.5.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Adminer versions from 4.6.0 up to, but not including, 5.5.0 are affected when an attacker can send a client-controlled X-Forwarded-Prefix header to Adminer. The vulnerable behavior does not require a trusted-proxy check.
What does an attacker need to exploit it?
The attacker needs network access to send requests to Adminer and must be able to supply X-Forwarded-Prefix with an absolute URL. Exploiting the redirect after a state-changing POST requires an authenticated user interaction; session cookie-path manipulation and self-referential link poisoning are described as unauthenticated.
What is the impact of supplying a malicious X-Forwarded-Prefix value?
A supplied absolute URL can be incorporated into Location redirect headers, the Path attribute of Set-Cookie headers, and self-referential links. CR/LF injection is not possible, so the issue does not enable header splitting or XSS through this vector.