CVE-2026-34959

Name of the Vulnerable Software and Affected Versions Adminer versions 4.6.0 through 5.4.x

Description The software prepends the client-supplied X-Forwarded-Prefix header to $ SERVER["REQUEST URI"] without performing a trusted-proxy check or validating the prefix value. An attacker can provide an absolute URL via the X-Forwarded-Prefix header, which is then incorporated into Location redirect headers, the Set-Cookie path attribute, and self-referential links. This allows for an authenticated open redirect following state-changing POST requests, unauthenticated control over the session cookie path attribute, and the poisoning of self-referential links. Header splitting and Cross-Site Scripting (XSS) are not possible as Carriage Return/Line Feed (CR/LF) characters cannot be injected.

Recommendations Update to version 5.5.0 or later.