CVE-2026-56706

Name of the Vulnerable Software and Affected Versions Adminer versions prior to 5.4.3

Description The software uses a CSRF token scheme that transmits both the XOR mask and the masked value in every token. This allows an attacker who observes a single token to recover the session secret using a single XOR operation and forge unlimited valid tokens. The security is further compromised by a low-entropy session token, which allows blind brute-force attacks, and the use of loose comparison (==) during token verification, which enables PHP type juggling (a behavior where PHP converts types automatically during comparison, potentially leading to unexpected results). This allows for cross-site request forgery against authenticated sessions, which can lead to the execution of arbitrary SQL queries.

Recommendations Update to version 5.4.3 or later.