CVE-2026-16434
Received Received - Intake

X-Forwarded-Prefix Bypass in Adminer

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: VulnCheck

Description
Adminer 4.6.0 through 5.5.0 (fixed in 5.5.1) contains an incomplete fix for a prior X-Forwarded-Prefix vulnerability (GHSA-8478-xrj3-h9c2). The validation guard (bootstrap.inc.php) only rejects prefixes matching ^/[^/], blocking //evil.com but allowing values such as /\evil.com whose second character is a backslash. Because browsers normalize backslash to forward slash, a network-path reference survives into REQUEST_URI and reaches cookie_path(), affecting the Set-Cookie Path attribute. Exploitation requires that clients can set the X-Forwarded-Prefix header (a misconfigured or absent reverse proxy). Impact is limited to anomalous cookie-path scoping.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-25
Last Modified
2026-08-25
Generated
2026-08-25
AI Q&A
2026-08-25
EPSS Evaluated
N/A
NVD
CVE-2026-16434
EUVD
EUVD-2026-65195

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
adminer adminer From 4.6.0 (inc) to 5.5.0 (inc)
adminer adminer 5.5.1
vrana adminer From 4.6.0 (inc) to 5.5.0 (inc)
vrana adminer to 5.5.0 (inc)
vrana adminer 5.5.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-20 The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Adminer versions 4.6.0 to 5.5.0 contain an incomplete fix for an X-Forwarded-Prefix vulnerability. The validation guard only blocks prefixes like //evil.com but fails to reject values such as /\evil.com where the second character is a backslash. Browsers normalize backslashes to forward slashes, allowing the malicious prefix to affect the Set-Cookie Path attribute. This results in anomalous cookie-path scoping.

Detection Guidance

To detect this vulnerability, check Adminer versions between 4.6.0 and 5.5.0. Run: curl -s http://your-adminer-instance/ | grep -i adminer. If version is in this range, it is vulnerable. Also inspect network traffic for X-Forwarded-Prefix headers with backslash-prefixed values like /\evil.com.

Impact Analysis

This vulnerability could allow attackers to manipulate cookie paths, potentially leading to session fixation or cookie manipulation attacks. However, exploitation requires a misconfigured proxy that permits client-settable X-Forwarded-Prefix headers. The impact is limited to subtle cookie-path scoping issues rather than direct high-impact compromises.

Compliance Impact

This vulnerability has limited direct impact on compliance with standards like GDPR or HIPAA. It primarily affects cookie-path scoping, which could lead to session fixation or cookie manipulation under specific conditions. However, these issues are not directly tied to data breaches or unauthorized access, which are key concerns for GDPR and HIPAA. The low severity (CVSS 2.3) suggests minimal risk to compliance.

Mitigation Strategies

Upgrade Adminer to version 5.5.1 or later immediately. If upgrading is not possible, ensure reverse proxies are configured to block client-settable X-Forwarded-Prefix headers. Review cookie paths in Set-Cookie headers for anomalies.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-16434. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart