# CVE-2026-16434: Adminer X-Forwarded-Prefix backslash bypass in cookie path validation

Source: https://junglewise.ai/threats/cve-2026-16434-adminer-x-forwarded-prefix-backslash-bypass-in-cookie-path  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-25. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-16434 · Severity: info · CVSS 2.3 · Published 2026-08-25

Adminer is a popular web-based database administration tool. Versions 4.6.0 through 5.5.0 contain an incomplete security fix that allows attackers to manipulate HTTP cookie scope through a backslash character in the X-Forwarded-Prefix header. Exploitation requires a misconfigured or absent reverse proxy that allows clients to set this header. The impact is limited to incorrect cookie path scoping, posing minimal direct security risk.

## Quick answers

**Is CVE-2026-16434 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-16434 being exploited in the wild.

**How severe is CVE-2026-16434?** Informational severity, with a CVSS score of 2.3, published 25 August 2026.

**Which products and versions are affected?** vrana Adminer 4.6.0 through 5.5.0 (fixed in 5.5.1).

**Is there a fix for CVE-2026-16434?** A patch was published on 2026-08-25: Patched in version 5.5.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-16434 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-16434?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This vulnerability is an incomplete fix for a prior X-Forwarded-Prefix validation flaw (GHSA-8478-xrj3-h9c2). The validation regex in bootstrap.inc.php uses ~^/[^/]~ to block network-path references like //evil.com, but fails to exclude backslash characters. A payload like /\evil.com passes this check; since browsers normalize backslash to forward slash, the tainted value persists into REQUEST_URI and reaches the cookie_path() function (functions.inc.php:324), affecting the Set-Cookie Path attribute. Exploitation requires that the application or upstream proxy allows clients to set the X-Forwarded-Prefix header. The vulnerability was patched in version 5.5.1 with a corrected validation regex that properly rejects backslash characters.

## Affected products

- vrana Adminer 4.6.0 through 5.5.0 (fixed in 5.5.1)

## Timeline

- 2026-07-21: disclosed: GHSA-fr74-9mf9-gf44 published
- 2026-08-25: patched: Patched in version 5.5.1

## References

- [https://github.com/vrana/adminer/security/advisories/GHSA-fr74-9mf9-gf44](https://github.com/vrana/adminer/security/advisories/GHSA-fr74-9mf9-gf44)
- [https://www.vulncheck.com/advisories/adminer-before-x-forwarded-prefix-backslash-bypass](https://www.vulncheck.com/advisories/adminer-before-x-forwarded-prefix-backslash-bypass)