Cross-Site Request Forgery Vulnerability in Adminer by VRana

CVE-2026-56706

What is CVE-2026-56706?

Adminer prior to version 5.4.3 implements a flawed CSRF token scheme, which allows sensitive session secrets to be retrieved through a straightforward XOR operation. This vulnerability arises because the token encodes both the XOR mask and the masked value, making it susceptible to interception via network sniffing or logs. Furthermore, the use of a low-entropy session token allows attackers to exploit it through brute-force methods. This significant oversight can lead to unauthorized actions performed on behalf of authenticated users, including the execution of arbitrary SQL queries, posing a serious risk to data integrity and security.

References