Adminer 5.5.1 through 6.0.1 improperly parses the login 'server' string in the host_port() function, where the port capture group requires digits anchored to the end of the string. If the server string contains a non-digit suffix, the regex fails and returns the entire string as the host with an empty port. The privileged-port restriction only checks the parsed port, so it is bypassed. The mysqli/mysqlnd client then re-parses the host:port from the host string and opens a TCP connection. This enables a remote unauthenticated attacker who can access the Adminer login page to submit crafted values (e.g., 127.0.0.1:80/x) that cause the server to initiate TCP connections to arbitrary internal hosts and privileged ports before credentials are validated. This allows SSRF and blind internal port scanning. This vulnerability is a regression of a previously fixed issue (GHSA-58cq-mgw2-38m5) and was fixed in Adminer 6.0.2.

An unauthenticated remote attacker can exploit this vulnerability to perform server-side request forgery, causing the server to initiate TCP connections to arbitrary internal hosts and ports. This can be used for blind internal port scanning and potentially to access internal network resources that are otherwise inaccessible. The vulnerability occurs before authentication, increasing the risk of unauthorized internal network reconnaissance.

Upgrade Adminer to version 6.0.2 or later, where this vulnerability is fixed. No other mitigations are indicated as the fix is official and addresses the root cause.