CVE-2026-16434: Improper Input Validation in vrana adminer

CVE-2026-16434 affects Adminer versions 4.6.0 through 5.5.0 and involves improper input validation of the X-Forwarded-Prefix header. The validation logic in bootstrap.inc.php rejects prefixes matching ^/[^/], blocking double forward slashes but allowing prefixes where the second character is a backslash (e.g., /\evil.com). Since browsers normalize backslashes to forward slashes, this malformed prefix survives into REQUEST_URI and influences the Set-Cookie Path attribute via cookie_path(). Successful exploitation requires that an attacker can set the X-Forwarded-Prefix header, which is possible if the reverse proxy is misconfigured or absent. The vulnerability leads to anomalous cookie-path scoping but does not escalate privileges or expose sensitive data. The issue was fixed in Adminer 5.5.1.

The vulnerability allows attackers who can set the X-Forwarded-Prefix header to influence cookie path scoping by bypassing input validation with backslash characters. This can cause anomalous cookie-path behavior, potentially affecting cookie security boundaries. However, the impact is limited to cookie-path scoping anomalies and does not directly lead to privilege escalation or data disclosure. The CVSS score is low (2.3), reflecting the limited impact and the requirement for a specific misconfiguration to exploit.

Upgrade Adminer to version 5.5.1 or later, where this issue is fixed. Ensure reverse proxies are correctly configured to prevent clients from setting the X-Forwarded-Prefix header. No other mitigations are necessary as the vulnerability requires this specific header manipulation and is fixed in the official patch.