Is CVE-2026-96632 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-96632 being exploited in the wild.

How severe is CVE-2026-96632?

High severity, with a CVSS score of 4, published 30 October 2026.

Which products and versions are affected?

adminneo-org/adminneo (Packagist) < 5.5.1, ECOSYSTEM:introduced=0,fixed=5.5.1.

Is there a fix for CVE-2026-96632?

Yes. adminneo-org/adminneo (Packagist): upgrade to 5.5.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-96632 attacked?

It is attacked over the network.

Am I affected by CVE-2026-96632?

Check whether you run adminneo-org/adminneo (Packagist) or AdminNeo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-96632: AdminNeo XSS via rogue MySQL server version string (CSP nonce bypass)

Q: Is there a fix for CVE-2026-96632?

Yes. adminneo-org/adminneo (Packagist): upgrade to 5.5.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-96632 attacked?

It is attacked over the network.

Q: Am I affected by CVE-2026-96632?

Check whether you run adminneo-org/adminneo (Packagist) or AdminNeo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-96632 · Severity: high · CVSS 4 · Published 2026-10-30

AdminNeo is a database management interface that connects to MySQL servers. When connecting to a database, it unsafely inserts the server's version string into a trusted JavaScript context protected by Content Security Policy. An attacker controlling a rogue MySQL server can inject malicious code in the version string, bypassing CSP protections to execute arbitrary JavaScript in the context of the AdminNeo application, potentially stealing session tokens or modifying data.

Technologies: adminneo-org/adminneo (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2026-96632 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-96632 being exploited in the wild.
How severe is CVE-2026-96632?: High severity, with a CVSS score of 4, published 30 October 2026.
Which products and versions are affected?: adminneo-org/adminneo (Packagist) < 5.5.1, ECOSYSTEM:introduced=0,fixed=5.5.1.
Is there a fix for CVE-2026-96632?: Yes. adminneo-org/adminneo (Packagist): upgrade to 5.5.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-96632 attacked?: It is attacked over the network.
Am I affected by CVE-2026-96632?: Check whether you run adminneo-org/adminneo (Packagist) or AdminNeo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

adminneo-org/adminneo (Packagist): upgrade to 5.5.1 or later
```
composer require adminneo-org/adminneo:^5.5.1
```

Technical details

AdminNeo inserts the unescaped output of Connection::get()->getVersion() into a script tag that carries a valid CSP nonce without sanitization, allowing a break-out from the JavaScript string context. An attacker controlling a reachable MySQL server can craft a version string that injects arbitrary JavaScript code which executes with the nonce bypass. The vulnerability can be triggered unauthenticated via login CSRF, requiring only that the victim's browser connect to the attacker's rogue MySQL server.

Affected products

AdminNeo

Identifiers

CVE-2026-96632
GHSA-rx7m-wxwq-vxr9

Timeline

2026-10-30: disclosed

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.