Open Redirect Vulnerability in Adminer Web Tool by Adminer

CVE-2026-34959

What is CVE-2026-34959?

Adminer versions prior to 5.5.0 are vulnerable due to improper handling of the X-Forwarded-Prefix header. This flaw allows attackers to prepend unvalidated values to the $_SERVER['REQUEST_URI']. By supplying an absolute URL, such as 'X-Forwarded-Prefix: https://evil.example', attackers can exploit the vulnerability to manipulate Location redirect headers, control the path attribute of session cookies, and alter self-referential links. While the vulnerability does not permit CR/LF injection, it facilitates an authenticated open redirect following state-altering POST requests, which can lead to serious implications for session integrity and security.

References