CVE-2026-63771: Adminer Auth Bypass Vulnerability

CVE-2026-63771 Overview

CVE-2026-63771 is a cookie injection vulnerability affecting Adminer versions prior to 5.4.3. The flaw resides in how Adminer constructs the Set-Cookie header path attribute using the unsanitized X-Forwarded-Prefix HTTP header. Attackers can inject arbitrary cookie attributes when Adminer runs behind a misconfigured reverse proxy. Successful exploitation allows downgrading SameSite protections and enabling cross-origin authenticated requests. The vulnerability is classified under [CWE-113] (HTTP Response Splitting) and carries a CVSS 4.0 base score of 6.0.

Critical Impact
Attackers can weaken cookie security controls on Adminer sessions, bypassing SameSite restrictions and enabling cross-origin authenticated requests against exposed database administration interfaces.

Affected Products

Adminer versions before 5.4.3
Adminer deployments behind reverse proxies that forward the X-Forwarded-Prefix header
Web-facing Adminer database management installations

Discovery Timeline

2026-07-20 - CVE-2026-63771 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-63771

Vulnerability Analysis

Adminer is a lightweight PHP-based database management tool commonly deployed behind reverse proxies. The vulnerable code path uses the X-Forwarded-Prefix HTTP header to build the path attribute of the session Set-Cookie response header. Adminer does not sanitize the header value before concatenating it into the outgoing header. An attacker who can send a crafted X-Forwarded-Prefix value can inject additional cookie attributes, including SameSite, Domain, and Secure directives. The result is a downgrade of built-in cookie protections that normally restrict cross-origin authenticated requests. Exploitation requires that the deployed reverse proxy forwards the attacker-controlled header without stripping or validating it.

Root Cause

The root cause is improper neutralization of CRLF and attribute-delimiting characters in HTTP header output, aligned with [CWE-113]. Adminer trusts the X-Forwarded-Prefix header as internal proxy metadata but reflects its contents directly into Set-Cookie path values. This missing input sanitization enables cookie attribute injection.

Attack Vector

The attack is network-based and requires user interaction, typically an authenticated Adminer user visiting an attacker-influenced page. When Adminer sits behind a reverse proxy that passes the X-Forwarded-Prefix header from client requests, an attacker crafts a request containing malicious characters in that header. Adminer echoes the value into the cookie path attribute, appending attacker-controlled directives such as SameSite=None. Subsequent cross-site requests then carry the authenticated session cookie, enabling CSRF-style abuse against database operations. Full technical details are available in the VulnCheck Cookie Injection Advisory.

Detection Methods for CVE-2026-63771

Indicators of Compromise

HTTP requests containing suspicious characters, semicolons, or SameSite tokens in the X-Forwarded-Prefix header
Set-Cookie response headers from Adminer containing unexpected attributes appended after the path value
Cross-origin requests to Adminer endpoints carrying valid session cookies from unexpected referrers

Detection Strategies

Inspect reverse proxy access logs for anomalous X-Forwarded-Prefix header values containing control characters, whitespace, or attribute keywords such as SameSite, Domain, or Secure
Review web application firewall (WAF) rules to identify Adminer responses where the Set-Cookie header contains multiple path fragments or injected attributes
Correlate authenticated Adminer sessions with unusual cross-origin Origin or Referer headers

Monitoring Recommendations

Enable verbose logging of HTTP request headers at the reverse proxy tier for all Adminer virtual hosts
Alert on outbound Set-Cookie headers from Adminer that deviate from a known-good template
Track version inventory for Adminer instances to confirm all deployments are running 5.4.3 or later

How to Mitigate CVE-2026-63771

Immediate Actions Required

Upgrade Adminer to version 5.4.3 or later, as documented in the GitHub Release Notes
Configure reverse proxies to strip or overwrite the X-Forwarded-Prefix header on all inbound requests before forwarding to Adminer
Restrict Adminer access to trusted networks, VPNs, or authenticated administrative zones

Patch Information

The Adminer maintainers addressed the vulnerability in release 5.4.3. The fix sanitizes the X-Forwarded-Prefix value before it is used in the Set-Cookie path attribute. Refer to the GitHub Security Advisory GHSA-c533-9qwm-8w5h and the original GitHub Issue Report for implementation details.

Workarounds

Deploy a reverse proxy rule that removes or replaces incoming X-Forwarded-Prefix headers before they reach Adminer
Place Adminer behind an authentication proxy or IP allowlist to prevent unauthenticated attacker interaction
Enforce SameSite=Strict and Secure cookie attributes at the reverse proxy layer using response header rewriting

bash

# Configuration example: strip X-Forwarded-Prefix in nginx before proxying to Adminer
location /adminer/ {
    proxy_set_header X-Forwarded-Prefix "";
    proxy_pass http://adminer_backend;
}