CVE-2026-63771: Vrana Adminer cookie injection via X-Forwarded-Prefix header

CVE-2026-63771 · Severity: high · CVSS 7.1 · Published 2026-07-20

Adminer, a popular web-based database management tool, is vulnerable to a security flaw that allows attackers to manipulate browser cookies. By sending a specially crafted web request through a misconfigured proxy server, an attacker can trick a user's browser into sending sensitive session information to a server controlled by the attacker. This could lead to unauthorized access to the database management interface and the theft of database credentials.

Quick answers

Is CVE-2026-63771 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-63771 being exploited in the wild.
How severe is CVE-2026-63771?
High severity, with a CVSS score of 7.1, published 20 July 2026.
Which products and versions are affected?
vrana Adminer >= 4.6.0, <= 5.4.2.
Is there a fix for CVE-2026-63771?
A patch was published on 2026-07-09: Version 5.4.3 released with fix Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-63771 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-63771?
Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

Adminer versions 4.6.0 through 5.4.2 are vulnerable to cookie attribute injection (CWE-113) because the application unsafely prepends the 'X-Forwarded-Prefix' HTTP header to the 'REQUEST_URI' global variable. This tainted value is subsequently used to manually construct 'Set-Cookie' headers and configure session cookie parameters without sanitizing semicolons or other attribute delimiters. An attacker can exploit this in environments where a reverse proxy forwards client-supplied headers to inject attributes such as 'Domain', 'SameSite=None', or 'Secure'. This can be used to leak the 'adminer_sid' (session ID) and 'adminer_key' (database encryption key) to an attacker-controlled domain or to bypass CSRF protections by downgrading SameSite attributes. The issue is fixed in version 5.4.3 by escaping the REQUEST_URI.

Affected products

  • vrana Adminer >= 4.6.0, <= 5.4.2

Timeline

  • 2026-06-02: disclosed: Vulnerability reported to vendor
  • 2026-07-09: patched: Version 5.4.3 released with fix
  • 2026-07-20: advisory: NVD publication date

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.