Vrana Adminer up to 5.5.0 Validation Guard bootstrap.inc.php cookie_path X-Forwarded-Prefix protection mechanism

Summaryinfo

A vulnerability marked as problematic has been reported in Vrana Adminer up to 5.5.0. This vulnerability affects the function cookie_path of the file bootstrap.inc.php of the component Validation Guard. Performing a manipulation of the argument X-Forwarded-Prefix results in protection mechanism. This vulnerability is identified as CVE-2026-16434. The attack can be initiated remotely. There is not any exploit available.

Detailsinfo

A vulnerability was found in Vrana Adminer up to 5.5.0. It has been classified as problematic. This affects the function cookie_path of the file bootstrap.inc.php of the component Validation Guard. The manipulation of the argument X-Forwarded-Prefix with an unknown input leads to a protection mechanism vulnerability. CWE is classifying the issue as CWE-693. The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product. This is going to have an impact on confidentiality. The summary by CVE is:

Adminer 4.6.0 through 5.5.0 (fixed in 5.5.1) contains an incomplete fix for a prior X-Forwarded-Prefix vulnerability (GHSA-8478-xrj3-h9c2). The validation guard (bootstrap.inc.php) only rejects prefixes matching ^/[^/], blocking //evil.com but allowing values such as /\evil.com whose second character is a backslash. Because browsers normalize backslash to forward slash, a network-path reference survives into REQUEST_URI and reaches cookie_path(), affecting the Set-Cookie Path attribute. Exploitation requires that clients can set the X-Forwarded-Prefix header (a misconfigured or absent reverse proxy). Impact is limited to anomalous cookie-path scoping.

The advisory is shared at github.com. This vulnerability is uniquely identified as CVE-2026-16434 since 07/21/2026. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details are known, but no exploit is available.

By approaching the search of inurl:bootstrap.inc.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 5.5.1 eliminates this vulnerability.

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Vendor

• Vrana

Name

• Adminer

Version

• 5.0
• 5.1
• 5.2
• 5.3
• 5.4
• 5.5.0

Website

• Product: https://github.com/vrana/adminer/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion