# CVE-2026-34959: Adminer X-Forwarded-Prefix open redirect and cookie path hijacking

Source: https://junglewise.ai/threats/cve-2026-34959-adminer-x-forwarded-prefix-open-redirect-and-cookie-path  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-25. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-34959 · Severity: medium · CVSS 4.7 · Published 2026-08-25

Adminer, a popular database management tool, unsafely processes the X-Forwarded-Prefix HTTP header without validating the proxy source or prefix value. An attacker can inject an absolute URL into this header to redirect users to attacker-controlled sites after performing database operations, manipulate session cookie scope, or poison self-referential links in the application. While existing authentication prevents the most direct attacks, this creates an open redirect vulnerability and enables session hijacking risks on shared hosting environments.

## Quick answers

**Is CVE-2026-34959 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-34959 being exploited in the wild.

**How severe is CVE-2026-34959?** Medium severity, with a CVSS score of 4.7, published 25 August 2026.

**Which products and versions are affected?** Vrana Adminer 4.6.0 to 5.4.4.

**Is there a fix for CVE-2026-34959?** A patch was published on 2026: Fixed in version 5.5.0 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-34959 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-34959?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability lies in Adminer's reverse-proxy support (bootstrap.inc.php:40-42), which blindly prepends the client-supplied X-Forwarded-Prefix header to $_SERVER["REQUEST_URI"] with no validation or trusted-proxy checking. Because REQUEST_URI always begins with "/", an attacker-supplied prefix like "https://evil.example" creates an absolute URL that flows into three sinks: Location redirect headers (used in db.inc.php, edit.inc.php), the Set-Cookie path attribute via cookie_path() function, and self-referential links. The attack requires network access (spoofable header) but triggers different impacts: authenticated users performing state-changing POSTs (table operations) receive open-redirect responses; unauthenticated attackers can control the session cookie path attribute to enable session-fixation attacks on shared hosts; all users see poisoned self-referential URLs. CR/LF injection is blocked by PHP's header() function, preventing header splitting or XSS. Patched in version 5.5.0.

## Affected products

- Vrana Adminer 4.6.0 to 5.4.4

## Timeline

- 2026-07-17: disclosed: GHSA-8478-xrj3-h9c2 published on GitHub
- 2026-08-25: other: CVE-2026-34959 published on NVD
- 2026: patched: Fixed in version 5.5.0

## References

- [https://github.com/vrana/adminer/security/advisories/GHSA-8478-xrj3-h9c2](https://github.com/vrana/adminer/security/advisories/GHSA-8478-xrj3-h9c2)
- [https://www.vulncheck.com/advisories/adminer-before-open-redirect-via-x-forwarded-prefix](https://www.vulncheck.com/advisories/adminer-before-open-redirect-via-x-forwarded-prefix)