CVE-2026-16434

Name of the Vulnerable Software and Affected Versions Adminer versions 4.6.0 through 5.5.0

Description An incomplete fix in the validation guard within bootstrap.inc.php allows certain values in the X-Forwarded-Prefix header to bypass security checks. While the system blocks prefixes starting with //, it permits values where the second character is a backslash, such as /evil.com. Since browsers normalize backslashes to forward slashes, this network-path reference persists in the REQUEST URI and reaches the cookie path() function, which affects the Set-Cookie Path attribute. This issue can be exploited if clients can set the X-Forwarded-Prefix header, typically due to a misconfigured or absent reverse proxy, resulting in anomalous cookie-path scoping.

Recommendations Update Adminer to version 5.5.1. Restrict the ability of clients to set the X-Forwarded-Prefix header by properly configuring the reverse proxy.