CVE-2026-34959: Adminer Auth Bypass Vulnerability

CVE-2026-34959 Overview

CVE-2026-34959 affects Adminer, a PHP-based database management tool, in versions 4.6.0 through releases prior to 5.5.0. The application prepends the client-supplied X-Forwarded-Prefix header to $_SERVER["REQUEST_URI"] without a trusted-proxy check and without validating the prefix value. Attackers can supply an absolute URL that flows into Location redirect headers, the Set-Cookie path attribute, and self-referential links. The flaw is categorized under CWE-20: Improper Input Validation.

Critical Impact
Unauthenticated attackers can control session cookie path attributes and poison self-referential links, while authenticated flows can be redirected to attacker-controlled domains after state-changing POST requests.

Affected Products

Adminer versions 4.6.0 and later
Adminer versions prior to 5.5.0
Deployments exposing Adminer behind reverse proxies or directly to untrusted networks

Discovery Timeline

2026-08-25 - CVE-2026-34959 published to the National Vulnerability Database (NVD)
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-34959

Vulnerability Analysis

Adminer processes the X-Forwarded-Prefix HTTP header to construct URLs used in redirects, cookie path attributes, and links rendered back to the client. The application prepends the header value to $_SERVER["REQUEST_URI"] without verifying that the request originates from a trusted proxy. It also fails to validate that the prefix is a relative path rather than an absolute URL.

When an attacker supplies a value such as X-Forwarded-Prefix: https://evil.example, the tainted value propagates into three sinks. The first is the Location response header used for post-authentication redirects. The second is the path attribute of Set-Cookie responses controlling session scope. The third is HTML output containing self-referential links.

The attacker cannot inject carriage return or line feed characters, so HTTP header splitting and reflected cross-site scripting are not achievable through this vector. The impact is limited to open redirect, cookie scoping manipulation, and link poisoning.

Root Cause

The root cause is improper input validation of a client-controlled HTTP header. Adminer trusts X-Forwarded-Prefix as if it originated from a legitimate reverse proxy, but no allowlist of trusted upstream proxies exists and no scheme or format validation is applied to the prefix value before concatenation with the request URI.

Attack Vector

Exploitation requires an attacker to send an HTTP request to a vulnerable Adminer instance with a crafted X-Forwarded-Prefix header containing an absolute URL. For the open redirect variant, the victim must interact with a state-changing POST flow after receiving the poisoned link. For cookie path manipulation, no user interaction beyond visiting the crafted request is required. Refer to the GitHub Security Advisory GHSA-8478-xrj3-h9c2 and the VulnCheck Advisory on Adminer Open Redirect for additional technical detail.

Detection Methods for CVE-2026-34959

Indicators of Compromise

HTTP request logs containing X-Forwarded-Prefix header values that begin with http:// or https:// schemes
Location response headers referencing external domains following requests to Adminer endpoints
Set-Cookie responses where the path attribute contains an absolute URL rather than a relative path
Access log entries from clients not originating from known reverse proxy addresses that include forwarding headers

Detection Strategies

Inspect web server and application logs for X-Forwarded-Prefix headers containing absolute URLs or unexpected characters
Alert on outbound redirect responses from Adminer hosts that target domains outside the organization's approved list
Compare source IP addresses of requests carrying forwarding headers against the allowlist of legitimate reverse proxies

Monitoring Recommendations

Enable verbose HTTP header logging on any web application firewall (WAF) or reverse proxy fronting Adminer
Continuously monitor for anomalous Set-Cookie path values and unexpected external Location headers
Correlate authentication events with subsequent redirect responses to identify potential post-login redirect abuse

How to Mitigate CVE-2026-34959

Immediate Actions Required

Upgrade Adminer to version 5.5.0 or later, which addresses the improper handling of the X-Forwarded-Prefix header
Restrict network access to Adminer instances so they are reachable only through trusted reverse proxies or authenticated administrative networks
Configure the fronting proxy or WAF to strip or overwrite the X-Forwarded-Prefix header on inbound requests from untrusted clients

Patch Information

The vulnerability is fixed in Adminer 5.5.0. Administrators running versions 4.6.0 through 5.4.x should upgrade using the release artifacts referenced in the GitHub Security Advisory GHSA-8478-xrj3-h9c2. Verify the deployed version after the upgrade and review any custom deployment scripts that may reintroduce vulnerable code.

Workarounds

Deploy a reverse proxy rule that removes the X-Forwarded-Prefix header from incoming requests before they reach Adminer
Enforce a WAF rule that rejects requests where X-Forwarded-Prefix contains :// or begins with http
Limit Adminer access to authenticated administrators over VPN or IP-restricted management networks until the upgrade is applied

bash

# Example nginx configuration to strip the header before proxying to Adminer
location /adminer/ {
    proxy_set_header X-Forwarded-Prefix "";
    proxy_pass http://adminer_backend;
}