CVE-2026-16434 describes an improper input validation vulnerability in Adminer 4.6.0 through 5.5.0 related to the X-Forwarded-Prefix header. The validation logic in bootstrap.inc.php rejects prefixes matching ^/[^/], blocking double forward slashes but allowing prefixes with a backslash as the second character (e.g., /\evil.com). Since browsers normalize backslashes to forward slashes, this allows a network-path reference to bypass validation and reach the cookie_path() function, affecting the Set-Cookie Path attribute. Successful exploitation requires that an attacker can set the X-Forwarded-Prefix header, which is possible if the reverse proxy is misconfigured or absent. The impact is limited to anomalous cookie-path scoping, which is a low-severity issue. The vulnerability was fixed in Adminer version 5.5.1.

The vulnerability allows an attacker who can control the X-Forwarded-Prefix header to influence the Set-Cookie Path attribute by bypassing input validation through backslash normalization. This can lead to anomalous cookie-path scoping, potentially affecting cookie handling and security boundaries. However, the impact is limited and does not allow privilege escalation, code execution, or data disclosure. The CVSS score is low (2.3), reflecting the limited impact and the requirement for specific conditions (ability to set the header).

Upgrade Adminer to version 5.5.1 or later, where this vulnerability is fixed. If upgrading is not immediately possible, ensure that reverse proxies are correctly configured to prevent client control of the X-Forwarded-Prefix header. Patch status is not explicitly stated beyond the fixed version 5.5.1, so check vendor advisories for any additional guidance.