Is CVE-2026-56706 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-56706 being exploited in the wild.

How severe is CVE-2026-56706?

Medium severity, with a CVSS score of 6.8, published 25 August 2026.

Which products and versions are affected?

Adminer Project Adminer before 5.4.3.

Is there a fix for CVE-2026-56706?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-56706 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-56706?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-56706: Adminer CSRF token secret recovery via XOR masking

CVE-2026-56706 · Severity: medium · CVSS 6.8 · Published 2026-08-25

Adminer is a popular web-based database management tool used to administer databases. A flaw in its CSRF protection allows attackers who observe even a single session token (through network logs, browser history, or other means) to instantly recover the session secret and forge unlimited forged tokens. This enables attackers to execute arbitrary SQL commands, delete databases, create backdoor accounts, or modify data on behalf of authenticated users without their knowledge or consent.

Quick answers

Is CVE-2026-56706 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-56706 being exploited in the wild.
How severe is CVE-2026-56706?: Medium severity, with a CVSS score of 6.8, published 25 August 2026.
Which products and versions are affected?: Adminer Project Adminer before 5.4.3.
Is there a fix for CVE-2026-56706?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-56706 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-56706?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in Adminer's CSRF token generation and verification (functions.inc.php lines 897-905 and auth.inc.php lines 150 and 205). The token format (rand XOR secret):rand transmits both the XOR mask and masked value, allowing trivial recovery of the session secret via a single XOR operation (secret = masked_value XOR rand). Three compounding weaknesses: (1) instant secret recovery from any observed token, (2) low entropy session tokens (only ~20 bits from rand(1,1e6), enabling blind brute-force), and (3) loose comparison (==) in token verification allowing PHP type juggling. Exploitation requires observing a valid CSRF token or brute-forcing the low-entropy session secret, then generating forged tokens to execute arbitrary SQL queries within an authenticated session. The vulnerability has been patched in version 5.4.3.

Affected products

Adminer Project Adminer before 5.4.3

Timeline

2026-07-09: disclosed
2026-08-25: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.