CVE-2026-63771
Received Received - Intake

Adminer Cookie Injection via X-Forwarded-Prefix Header

Publication date: 2026-07-20

Last updated on: 2026-07-20

Assigner: VulnCheck

Description
Adminer before 5.4.3 contains a cookie injection vulnerability that allows attackers to manipulate cookie attributes by injecting arbitrary values through the unsanitized X-Forwarded-Prefix HTTP header used in Set-Cookie path attributes. Attackers can exploit a misconfigured reverse proxy to downgrade SameSite protection and enable cross-origin authenticated requests, bypassing cookie security controls.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-20
Last Modified
2026-07-20
Generated
2026-07-21
AI Q&A
2026-07-20
EPSS Evaluated
N/A
NVD
CVE-2026-63771
EUVD
EUVD-2026-46070

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
adminer adminer to 5.4.3 (exc)
vrana adminer to 5.4.3 (exc)
vrana adminer From 4.6.0 (inc) to 5.4.2 (inc)
vrana adminer 5.5.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-113 The product receives data from an HTTP agent/component (e.g., web server, proxy, browser, etc.), but it does not neutralize or incorrectly neutralizes CR and LF characters before the data is included in outgoing HTTP headers.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Adminer before version 5.4.3 has a vulnerability where attackers can manipulate cookie attributes by injecting values through the X-Forwarded-Prefix HTTP header. This header is used in Set-Cookie path attributes without proper sanitization, allowing attackers to downgrade SameSite cookie protection and bypass security controls.

Detection Guidance

To detect this vulnerability, inspect HTTP headers for the X-Forwarded-Prefix header in responses from Adminer. Check if Set-Cookie attributes are manipulated, particularly the path attribute. Use tools like curl to send requests with the header and observe cookie behavior.

Impact Analysis

Attackers could exploit this to perform cross-origin authenticated requests, potentially stealing session cookies or sensitive data. This could lead to unauthorized access to admin interfaces or user accounts if the reverse proxy is misconfigured.

Compliance Impact

This vulnerability could lead to unauthorized data access, violating GDPR's data protection requirements and HIPAA's security controls for protected health information. Organizations may face compliance violations if exploited.

Mitigation Strategies

Immediately upgrade Adminer to version 5.4.3 or later. Configure reverse proxies to sanitize or block the X-Forwarded-Prefix header. Ensure SameSite cookie attributes are set to Strict or Lax to prevent cross-origin requests.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63771. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart