Is CVE-2026-96629 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-96629 being exploited in the wild.

How severe is CVE-2026-96629?

Medium severity, with a CVSS score of 6.8, published 30 October 2026.

Which products and versions are affected?

AdminNeo 5.5.0 and likely earlier versions; adminneo-org/adminneo (Packagist) < 5.5.1, ECOSYSTEM:introduced=0,fixed=5.5.1.

Is there a fix for CVE-2026-96629?

Yes. adminneo-org/adminneo (Packagist): upgrade to 5.5.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-96629 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-96629?

Check whether you run AdminNeo or adminneo-org/adminneo (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-96629: AdminNeo CSRF token vulnerability with session secret recovery

Q: Is there a fix for CVE-2026-96629?

Yes. adminneo-org/adminneo (Packagist): upgrade to 5.5.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-96629 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-96629?

Check whether you run AdminNeo or adminneo-org/adminneo (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-96629 · Severity: medium · CVSS 6.8 · Published 2026-10-30

AdminNeo, a database administration interface, protects form submissions against cross-site request forgery (CSRF) attacks using tokens. However, the token design allows an attacker who observes a single token—through logs, network traffic, or other leakage—to instantly recover the session secret and forge valid tokens for any operation. An attacker can then perform arbitrary actions like dropping tables, creating backdoor accounts, or exfiltrating data under the victim's identity.

Technologies: AdminNeo, adminneo-org/adminneo (Packagist). Vendors: AdminNeo, Packagist.

Quick answers

Is CVE-2026-96629 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-96629 being exploited in the wild.
How severe is CVE-2026-96629?: Medium severity, with a CVSS score of 6.8, published 30 October 2026.
Which products and versions are affected?: AdminNeo 5.5.0 and likely earlier versions; adminneo-org/adminneo (Packagist) < 5.5.1, ECOSYSTEM:introduced=0,fixed=5.5.1.
Is there a fix for CVE-2026-96629?: Yes. adminneo-org/adminneo (Packagist): upgrade to 5.5.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-96629 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-96629?: Check whether you run AdminNeo or adminneo-org/adminneo (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

adminneo-org/adminneo (Packagist): upgrade to 5.5.1 or later
```
composer require adminneo-org/adminneo:^5.5.1
```

Technical details

The vulnerability has three components: (1) the CSRF token format transmits both the XOR mask and masked value (`(rand XOR secret):rand`), allowing trivial secret recovery via `secret = masked_value XOR rand`; (2) the session token uses only ~20 bits of entropy (`rand(1, 1e6)`), making blind brute-force feasible; (3) token verification uses loose PHP comparison (`==` instead of `===`), enabling type juggling. An authenticated user needs only to view a single token to forge unlimited valid CSRF tokens, then execute SQL queries via the web interface with no further user interaction required.

Affected products

AdminNeo AdminNeo 5.5.0 and likely earlier versions

Identifiers

CVE-2026-96629
GHSA-wm25-49w3-5qrg

Timeline

2026-10-30: disclosed: GHSA-wm25-49w3-5qrg published

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.