CVE-2026-63771: Adminer < 5.4.3 Cookie Injection via X-Forwarded-Prefix Header
Adminer before 5.4.3 contains a cookie injection vulnerability that allows attackers to manipulate cookie attributes by injecting arbitrary values through the unsanitized X-Forwarded-Prefix HTTP header used in Set-Cookie path attributes. Attackers can exploit a misconfigured reverse proxy to downgrade SameSite protection and enable cross-origin authenticated requests, bypassing cookie security controls.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Adminerto a version that resolves this vulnerability.Fixed in 5.4.3 - Compensating control
Ensure the reverse proxy does not pass an untrusted or attacker-controlled X-Forwarded-Prefix header to Adminer (sanitize/overwrite it or prevent clients from influencing it).
Event History
Frequently Asked Questions
What is the severity of CVE-2026-63771?
The severity of CVE-2026-63771 is rated as high with a score of 7.1.
How does CVE-2026-63771 affect Adminer?
CVE-2026-63771 allows attackers to perform cookie injection via the unsanitized X-Forwarded-Prefix header.
Which versions of Adminer are vulnerable to CVE-2026-63771?
Adminer versions prior to 5.4.3 are vulnerable to CVE-2026-63771.
How can I fix CVE-2026-63771?
To fix CVE-2026-63771, upgrade Adminer to version 5.4.3 or later.
What is the impact of exploiting CVE-2026-63771?
Exploiting CVE-2026-63771 can allow attackers to manipulate cookie attributes, potentially leading to session hijacking.