Is CVE-2026-16434 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-16434 being exploited in the wild.

How severe is CVE-2026-16434?

Informational severity, with a CVSS score of 2.3, published 25 August 2026.

Which products and versions are affected?

vrana Adminer 4.6.0 through 5.5.0 (fixed in 5.5.1).

Is there a fix for CVE-2026-16434?

A patch was published on 2026-08-25: Patched in version 5.5.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-16434 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-16434?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-16434: Adminer X-Forwarded-Prefix backslash bypass in cookie path validation

CVE-2026-16434 · Severity: info · CVSS 2.3 · Published 2026-08-25

Adminer is a popular web-based database administration tool. Versions 4.6.0 through 5.5.0 contain an incomplete security fix that allows attackers to manipulate HTTP cookie scope through a backslash character in the X-Forwarded-Prefix header. Exploitation requires a misconfigured or absent reverse proxy that allows clients to set this header. The impact is limited to incorrect cookie path scoping, posing minimal direct security risk.

Quick answers

Is CVE-2026-16434 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-16434 being exploited in the wild.
How severe is CVE-2026-16434?: Informational severity, with a CVSS score of 2.3, published 25 August 2026.
Which products and versions are affected?: vrana Adminer 4.6.0 through 5.5.0 (fixed in 5.5.1).
Is there a fix for CVE-2026-16434?: A patch was published on 2026-08-25: Patched in version 5.5.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-16434 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-16434?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability is an incomplete fix for a prior X-Forwarded-Prefix validation flaw (GHSA-8478-xrj3-h9c2). The validation regex in bootstrap.inc.php uses ~^/[^/]~ to block network-path references like //evil.com, but fails to exclude backslash characters. A payload like /\evil.com passes this check; since browsers normalize backslash to forward slash, the tainted value persists into REQUEST_URI and reaches the cookie_path() function (functions.inc.php:324), affecting the Set-Cookie Path attribute. Exploitation requires that the application or upstream proxy allows clients to set the X-Forwarded-Prefix header. The vulnerability was patched in version 5.5.1 with a corrected validation regex that properly rejects backslash characters.

Affected products

vrana Adminer 4.6.0 through 5.5.0 (fixed in 5.5.1)

Timeline

2026-07-21: disclosed: GHSA-fr74-9mf9-gf44 published
2026-08-25: patched: Patched in version 5.5.1

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.