Server-Side Request Forgery in Adminer by VRana

CVE-2026-34964

What is CVE-2026-34964?

An issue in Adminer prior to version 5.5.0 allows for server-side request forgery (SSRF) via improper validation of the server field in the login form. The server field's validator inadequately checks for non-numeric port values, enabling attackers to inject PDO DSN keys such as host= and port=. This security flaw permits unauthorized TCP connections to internal hosts and ports, bypassing privilege restrictions prior to user authentication, leading to potential exposure of sensitive data or additional attack vectors.

References