CVE-2026-16434: Adminer CSRF Vulnerability

CVE-2026-16434 Overview

CVE-2026-16434 affects Adminer versions 4.6.0 through 5.5.0 and is fixed in version 5.5.1. The vulnerability results from an incomplete fix for a prior X-Forwarded-Prefix issue tracked as GHSA-8478-xrj3-h9c2. The validation guard in bootstrap.inc.php rejects prefixes matching ^/[^/] but permits values such as /\evil.com, where the second character is a backslash. Browsers normalize backslash to forward slash, so the network-path reference survives into REQUEST_URI and reaches cookie_path(), influencing the Set-CookiePath attribute. Impact is limited to anomalous cookie-path scoping and requires that clients can set the X-Forwarded-Prefix header, typically through a misconfigured or absent reverse proxy.

Critical Impact

Attackers who can inject the X-Forwarded-Prefix header can manipulate the Set-CookiePath attribute, causing cookies to be scoped to attacker-controlled paths.

Affected Products

• Adminer 4.6.0 through 5.5.0
• Fixed in Adminer 5.5.1
• Deployments behind reverse proxies that pass through X-Forwarded-Prefix unfiltered

Discovery Timeline

• 2026-08-25 - CVE-2026-16434 published to NVD
• 2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-16434

Vulnerability Analysis

Adminer accepts the X-Forwarded-Prefix HTTP header to construct URL paths when running behind a reverse proxy. A prior advisory (GHSA-8478-xrj3-h9c2) added a validation guard in bootstrap.inc.php to reject header values beginning with two slashes, which browsers interpret as network-path references. The fix rejected inputs matching the regular expression ^/[^/], blocking values like //evil.com.

The validation does not account for backslash characters. A value such as /\evil.com passes the guard because the second character is a backslash rather than a forward slash. Browsers then normalize the backslash to a forward slash, producing an effective //evil.com reference that flows into REQUEST_URI and downstream into cookie_path(). The result reaches the Set-CookiePath attribute, allowing an attacker to influence cookie scoping.

The issue is classified as improper input validation [CWE-20]. Exploitation is limited to environments where the header reaches the application, and the practical impact is anomalous cookie path scoping rather than session theft or code execution.

Root Cause

The root cause is an incomplete deny-list regular expression. The guard in bootstrap.inc.php filters only forward-slash sequences and ignores backslash characters that browsers subsequently normalize into path separators.

Attack Vector

An attacker sends a crafted X-Forwarded-Prefix header containing a leading forward slash followed by a backslash and attacker-controlled content. When a reverse proxy is missing, misconfigured, or does not strip client-supplied headers, Adminer accepts the value. User interaction is required for the manipulated cookie path to take effect in the victim's browser. See the GitHub Security Advisory for full technical detail.

// No verified public exploit code is available.
// Refer to the vendor advisory for the exact validation regex and fix.

Detection Methods for CVE-2026-16434

Indicators of Compromise

• Inbound HTTP requests to Adminer endpoints containing an X-Forwarded-Prefix header value beginning with /\
• Set-Cookie response headers from Adminer with unexpected Path attribute values referencing external hosts
• Access logs showing REQUEST_URI values containing backslash sequences originating from client-supplied headers

Detection Strategies

• Inspect reverse proxy and web server logs for anomalous X-Forwarded-Prefix values, particularly those containing backslashes or encoded backslash sequences (%5C).
• Compare Set-CookiePath attribute values in Adminer responses against the expected application deployment path.
• Alert on Adminer instances running versions 4.6.0 through 5.5.0 identified through software inventory or version banner scanning.

Monitoring Recommendations

• Enable HTTP header logging on the reverse proxy layer to capture forwarded prefix headers for review.
• Monitor Adminer access patterns for requests originating from unexpected sources that also set forwarding headers.
• Track outbound cookie scoping anomalies through web application firewall response inspection.

How to Mitigate CVE-2026-16434

Immediate Actions Required

• Upgrade Adminer to version 5.5.1 or later, which contains the corrected validation logic.
• Configure the reverse proxy to strip or overwrite the X-Forwarded-Prefix header on inbound requests from untrusted clients.
• Audit deployments to confirm Adminer is not directly exposed to the internet without a properly configured reverse proxy.

Patch Information

The vendor fix is included in Adminer 5.5.1. The corrected validation guard in bootstrap.inc.php rejects both forward-slash and backslash characters as the second character of the prefix. Refer to the GitHub Security Advisory GHSA-fr74-9mf9-gf44 and the VulnCheck Advisory for full details.

Workarounds

• Remove or sanitize the X-Forwarded-Prefix header at the reverse proxy before requests reach Adminer.
• Restrict access to Adminer through network controls, IP allow-listing, or authenticated proxy layers.
• Deploy a web application firewall rule that blocks X-Forwarded-Prefix values containing backslashes or their URL-encoded equivalents.

# Example nginx directive to unset the header on inbound requests
proxy_set_header X-Forwarded-Prefix "";