Type Error Vulnerability in Adminer Database Management Software by Adminer

CVE-2026-25892

What is CVE-2026-25892?

A vulnerability exists in Adminer, an open-source database management tool, due to an ineffective version check mechanism. The application sends signed version information via JavaScript's postMessage method to a specific endpoint. Unfortunately, this endpoint does not validate the origin of POST requests, allowing malicious actors to send crafted requests containing the version[] parameter. When this parameter is interpreted by the backend, it is converted into an array rather than a string. As a result, when the application attempts to process this data with the openssl_verify() function, a TypeError occurs. This results in an HTTP 500 error for all users, effectively disrupting service. To mitigate this issue, users are advised to upgrade to Adminer version 5.4.2.

References