CVE-2026-16434 in Adminer
Summary
by MITRE • 08/25/2026
Adminer 4.6.0 through 5.5.0 (fixed in 5.5.1) contains an incomplete fix for a prior X-Forwarded-Prefix vulnerability (GHSA-8478-xrj3-h9c2). The validation guard (bootstrap.inc.php) only rejects prefixes matching ^/[^/], blocking //evil.com but allowing values such as /\evil.com whose second character is a backslash. Because browsers normalize backslash to forward slash, a network-path reference survives into REQUEST_URI and reaches cookie_path(), affecting the Set-Cookie Path attribute. Exploitation requires that clients can set the X-Forwarded-Prefix header (a misconfigured or absent reverse proxy). Impact is limited to anomalous cookie-path scoping.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 08/25/2026
The vulnerability in Adminer versions 4.6.0 through 5.5.0 represents a classic case of an incomplete fix for a previously identified security flaw, specifically related to the handling of the X-Forwarded-Prefix HTTP header. This issue stems from a failure to properly sanitize or validate user-supplied input that influences how cookies are scoped within the application environment. The original vulnerability allowed attackers to manipulate cookie paths through malicious prefix values sent via this header. While version 5.5.0 attempted to address part of this risk, it did so with insufficient validation logic in the bootstrap.inc.php file. Specifically, the code implemented a regular expression check that only rejected prefixes starting with a forward slash followed by any character other than another forward slash, expressed as ^/[^/]. This pattern effectively blocked attempts using double slashes such as //evil.com but failed to account for alternative representations of path traversal or domain injection involving backslashes.
The technical root cause lies in the inconsistent handling of URL delimiters across different layers of the request processing pipeline. The validation guard explicitly checks for patterns beginning with / followed by a non-slash character, thereby allowing inputs like /\evil.com where the second character is a backslash. Although this input appears to be blocked or ignored at first glance due to its deviation from standard forward-slash syntax, modern web browsers normalize backslashes into forward slashes during URL resolution. Consequently, when such a value reaches the server-side processing logic via REQUEST_URI, it is interpreted as /evil.com rather than /\evil.com. This normalization bypasses the initial validation check because the backend code sees what appears to be a valid path starting with a single slash followed by alphanumeric characters, thus passing the flawed security filter intact.
This discrepancy allows an attacker who can control or influence the X-Forwarded-Prefix header to inject arbitrary domain names into the cookie path attribute via the Set-Cookie response header. The operational impact of this flaw is primarily limited to anomalous cookie-path scoping rather than direct remote code execution or full session hijacking in all contexts. However, improper cookie scoping can lead to significant security degradation depending on how Adminer is deployed and configured within a larger infrastructure. If the application relies heavily on cookies for authentication state management without additional protections such as HttpOnly or Secure flags being strictly enforced alongside proper path restrictions, an attacker might exploit this misconfiguration to scope cookies incorrectly across subdomains or paths where they should not persist. This could potentially facilitate cross-site scripting attacks if combined with other vulnerabilities or allow unauthorized access under specific configuration scenarios involving shared domains and weak session management policies.
The exploitation of this vulnerability requires that clients have the ability to set the X-Forwarded-Prefix header, which typically indicates a misconfigured reverse proxy setup where untrusted input is passed directly into backend applications without adequate sanitization. In environments using Nginx or Apache as front-end proxies, if these servers are configured to pass through client-supplied headers unchecked, they become vectors for this attack. The absence of strict validation at the proxy level combined with the incomplete fix in Adminer creates a chain of trust failure that enables path manipulation. This scenario highlights the importance of defense-in-depth strategies where both network infrastructure and application code must enforce consistent input validation rules to prevent such bypasses.
From an industry standards perspective, this vulnerability aligns with CWE-20 Improper Input Validation as it involves failing to correctly validate user-supplied data before processing. It also relates to CWE-614 Sensitive Cookie in Incorrect Context if the resulting cookie scoping leads to exposure of sensitive session identifiers outside their intended domain scope. In terms of attack techniques, this falls under MITRE ATT&CK Tactic TA0005 Defense Evasion and specifically Technique T1136 Create Account or potentially T1078 Valid Accounts depending on whether the attacker uses legitimate credentials with manipulated context to maintain persistence or access. The use of backslash normalization as a bypass mechanism is reminiscent of techniques seen in path traversal attacks, although here it serves primarily to manipulate cookie attributes rather than file system paths.
Mitigation strategies should focus on both immediate remediation and long-term architectural improvements. Administrators running Adminer versions 4.6.0 through 5.5.0 must upgrade immediately to version 5.5.1 or later where the validation logic has been corrected to handle backslash characters appropriately, ensuring that all variations of path-like inputs are rejected unless they conform strictly to expected safe patterns. Additionally, organizations should review their reverse proxy configurations to ensure that headers like X-Forwarded-Prefix are either stripped entirely if not required by the application or validated against a whitelist of allowed values before being forwarded to backend services. Implementing Content Security Policy directives and ensuring cookies utilize HttpOnly, Secure, and SameSite attributes can further reduce the impact of any residual cookie manipulation risks. Regular security audits focusing on input validation across all layers of the stack will help prevent similar incomplete fixes from recurring in future updates or other web applications handling sensitive session data.