CVE-2026-100698
Received Received - Intake

Port Scanning via Adminer Server Parameter

Publication date: 2026-09-26

Last updated on: 2026-09-26

Assigner: VulnCheck

Description
Adminer 5.5.1 through 6.0.1 improperly parses the login 'server' string in the host_port() function in adminer/include/functions.inc.php. The port capture group requires pure digits anchored to the end of the string, so any server value with a non-digit tail fails the regex and falls back to returning the whole string as the host with an empty port. Because the privileged-port restriction in adminer/include/auth.inc.php inspects only the parsed port, the check is skipped, and the mysqli/mysqlnd client subsequently re-parses host:port from the host string and opens a TCP connection. A remote, unauthenticated attacker who can reach the Adminer login page can submit a crafted value such as 127.0.0.1:80/x to make the server initiate TCP connections to arbitrary internal hosts and privileged ports before credentials are validated, enabling server-side request forgery and blind internal port scanning (connection refused vs. handshake vs. timeout acts as a liveness oracle). This is a regression that re-opens the bypass fixed in 5.5.0 (GHSA-58cq-mgw2-38m5). Fixed in 6.0.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-26
Last Modified
2026-09-26
Generated
2026-09-26
AI Q&A
2026-09-26
EPSS Evaluated
N/A
NVD
CVE-2026-100698
EUVD
EUVD-2026-87671

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
adminer adminer From 5.5.1 (inc) to 6.0.1 (inc)
adminer adminer 6.0.2
vrana adminer to 6.0.2 (exc)
vrana adminer 6.0.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-918 The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in Adminer versions 5.5.1 through 6.0.1. It occurs due to improper parsing of the login server string in the host_port() function. When a server string like 127.0.0.1:80/x is submitted, the regex fails to match because of the non-digit suffix (/x), causing the function to return the entire string as the host with an empty port. This bypasses the privileged-port restriction, allowing the server to connect to arbitrary internal hosts and ports before authentication.

Detection Guidance

To detect this vulnerability, check if your Adminer version is between 5.5.1 and 6.0.1. Inspect the host_port() function in adminer/include/functions.inc.php for improper regex handling of server strings. Test by submitting crafted server values like 127.0.0.1:80/x in the login form and observe if connections are made to arbitrary internal hosts or privileged ports.

Impact Analysis

An unauthenticated attacker can exploit this to initiate TCP connections to internal hosts and privileged ports, enabling SSRF and blind internal port scanning. The server may connect to restricted internal services or scan for open ports, potentially exposing sensitive internal systems or data.

Mitigation Strategies

Upgrade Adminer to version 6.0.2 or later immediately. If upgrading is not possible, restrict access to the Adminer login page to trusted networks only. Monitor network traffic for unexpected outbound connections from the Adminer server.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100698. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart