# CVE-2026-96632: AdminNeo XSS via rogue MySQL server version string (CSP nonce bypass)

Source: https://junglewise.ai/threats/cve-2026-96632-adminneo-vulnerable-to-xss-via-rogue-mysql-server-version-string  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-30. Updated: 2026-10-30  
License: CC BY 4.0 with a link back

CVE-2026-96632 · Severity: high · CVSS 4 · Published 2026-10-30

AdminNeo is a database management interface that connects to MySQL servers. When connecting to a database, it unsafely inserts the server's version string into a trusted JavaScript context protected by Content Security Policy. An attacker controlling a rogue MySQL server can inject malicious code in the version string, bypassing CSP protections to execute arbitrary JavaScript in the context of the AdminNeo application, potentially stealing session tokens or modifying data.

Technologies: [adminneo-org/adminneo (Packagist)](https://junglewise.ai/threats/technologies/adminneo-org-adminneo). Vendors: [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-96632 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-96632 being exploited in the wild.

**How severe is CVE-2026-96632?** High severity, with a CVSS score of 4, published 30 October 2026.

**Which products and versions are affected?** adminneo-org/adminneo (Packagist) < 5.5.1, ECOSYSTEM:introduced=0,fixed=5.5.1.

**Is there a fix for CVE-2026-96632?** Yes. adminneo-org/adminneo (Packagist): upgrade to 5.5.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-96632 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-96632?** Check whether you run adminneo-org/adminneo (Packagist) or AdminNeo at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- adminneo-org/adminneo (Packagist): upgrade to 5.5.1 or later

  ```sh
  composer require adminneo-org/adminneo:^5.5.1
  ```


## Technical details

AdminNeo inserts the unescaped output of Connection::get()->getVersion() into a script tag that carries a valid CSP nonce without sanitization, allowing a break-out from the JavaScript string context. An attacker controlling a reachable MySQL server can craft a version string that injects arbitrary JavaScript code which executes with the nonce bypass. The vulnerability can be triggered unauthenticated via login CSRF, requiring only that the victim's browser connect to the attacker's rogue MySQL server.

## Affected products

- AdminNeo

## Identifiers

- CVE-2026-96632
- GHSA-rx7m-wxwq-vxr9

## Timeline

- 2026-10-30: disclosed

## Related threats

- [AdminNeo SQLite regex backtracking filter bypass in ATTACH statement check](https://junglewise.ai/threats/cve-2026-96634-adminneo-sqlite-multi-query-incorrect-check-of-function-return)
- [AdminNeo SQLite database-list drop arbitrary file deletion](https://junglewise.ai/threats/cve-2026-96633-adminneo-sqlite-database-list-drop-arbitrary-file-deletion)
- [AdminNeo cookie attribute injection via X-Forwarded-Prefix](https://junglewise.ai/threats/cve-2026-96631-adminneo-has-cookie-attribute-injection-via-unsanitized-x)
- [AdminNeo RCE via SQLite VACUUM INTO ATTACH blocklist bypass](https://junglewise.ai/threats/cve-2026-96630-adminneo-rce-via-sqlite-vacuum-into-attach-blocklist-bypass)
- [AdminNeo CSRF token vulnerability with session secret recovery](https://junglewise.ai/threats/cve-2026-96629-adminneo-csrf-token-secret-recoverable-from-single-observed-token)