Is CVE-2026-96631 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-96631 being exploited in the wild.

How severe is CVE-2026-96631?

High severity, with a CVSS score of 8.2, published 30 October 2026.

Which products and versions are affected?

AdminNeo 4.6.0 through 5.5.0; adminneo-org/adminneo (Packagist) >= 4.6.0, < 5.5.1, ECOSYSTEM:introduced=4.6.0,fixed=5.5.1.

How is CVE-2026-96631 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-96631?

Check whether you run AdminNeo or adminneo-org/adminneo (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-96631: AdminNeo cookie attribute injection via X-Forwarded-Prefix

Q: Is there a fix for CVE-2026-96631?

Yes. adminneo-org/adminneo (Packagist): upgrade to 5.5.1 or later. Until then: Configure the reverse proxy to set X-Forwarded-Prefix to a static, trusted value instead of forwarding the client-supplied header; for example, in nginx use `fastcgi_param HTTP_X_FORWARDED_PREFIX /adminneo;` with a hardcoded path, or in Traefik use the stripPrefix middleware instead of relying on client headers. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-96631 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-96631?

Check whether you run AdminNeo or adminneo-org/adminneo (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-96631 · Severity: high · CVSS 8.2 · Published 2026-10-30

AdminNeo is a web-based database management interface. Versions 4.6.0 through 5.5.0 fail to sanitize the X-Forwarded-Prefix HTTP header, allowing an attacker to inject cookie attributes. An attacker can redirect the session ID and database encryption key cookies to their own domain, enabling session hijacking and theft of stored database credentials.

Technologies: AdminNeo, adminneo-org/adminneo (Packagist). Vendors: AdminNeo, Packagist.

Quick answers

Is CVE-2026-96631 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-96631 being exploited in the wild.
How severe is CVE-2026-96631?: High severity, with a CVSS score of 8.2, published 30 October 2026.
Which products and versions are affected?: AdminNeo 4.6.0 through 5.5.0; adminneo-org/adminneo (Packagist) >= 4.6.0, < 5.5.1, ECOSYSTEM:introduced=4.6.0,fixed=5.5.1.
Is there a fix for CVE-2026-96631?: Yes. adminneo-org/adminneo (Packagist): upgrade to 5.5.1 or later. Until then: Configure the reverse proxy to set X-Forwarded-Prefix to a static, trusted value instead of forwarding the client-supplied header; for example, in nginx use `fastcgi_param HTTP_X_FORWARDED_PREFIX /adminneo;` with a hardcoded path, or in Traefik use the stripPrefix middleware instead of relying on client headers. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-96631 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-96631?: Check whether you run AdminNeo or adminneo-org/adminneo (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

adminneo-org/adminneo (Packagist): upgrade to 5.5.1 or later
```
composer require adminneo-org/adminneo:^5.5.1
```

Configure the reverse proxy to set X-Forwarded-Prefix to a static, trusted value instead of forwarding the client-supplied header; for example, in nginx use `fastcgi_param HTTP_X_FORWARDED_PREFIX /adminneo;` with a hardcoded path, or in Traefik use the stripPrefix middleware instead of relying on client headers.

Technical details

The vulnerability stems from three code defects: unsanitized concatenation of the X-Forwarded-Prefix header into REQUEST_URI, manual Set-Cookie header construction that interpolates the tainted REQUEST_URI without escaping semicolons, and similar tainting of the PHP session cookie path. An attacker who can control this header (via reverse proxy misconfiguration, upstream proxy, or MITM) can inject semicolon-delimited cookie attributes like Domain and SameSite, causing the browser to send sensitive cookies (neo_sid and neo_key) to an attacker-controlled domain.

Affected products

AdminNeo AdminNeo 4.6.0 through 5.5.0

Identifiers

CVE-2026-96631
GHSA-79wv-8rh2-9vp2

Timeline

2026-10-30: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.