X-Forwarded-Prefix Vulnerability in Adminer by VRana
CVE-2026-16434

2.3LOW

Key Information:

Vendor

Vrana

Status
Adminer
Vendor
CVE Published:
25 August 2026

What is CVE-2026-16434?

Adminer versions 4.6.0 to 5.5.0 contain an incomplete fix for a previously known X-Forwarded-Prefix vulnerability. This issue arises from a lax validation in the code, which incorrectly handles backslashes. While it successfully blocks certain malicious prefixes, it fails to reject leading prefixes like '/\evil.com' due to browser normalization processes. As a result, this can affect the Set-Cookie Path attribute in ways that could expose sensitive data or allow for unauthorized cookie manipulation, particularly in environments with misconfigured reverse proxies.

Affected Version(s)

adminer 0 < 5.5.1

adminer 5.5.1

References

https://github.com/vrana/adminer/security/advisories/GHSA...
vendor-advisory
https://www.vulncheck.com/advisories/adminer-before-x-for...
third-party-advisory

CVSS V4

Score:
2.3
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Infinit3i
.