CVE-2026-34959 describes an improper input validation vulnerability in Adminer versions 4.6.0 up to but not including 5.5.0. The application prepends the X-Forwarded-Prefix header value directly to $_SERVER["REQUEST_URI"] without verifying if the header originates from a trusted proxy or validating the prefix content. An attacker can supply an absolute URL in this header, which is then used in Location redirect headers, Set-Cookie path attributes, and self-referential links. This leads to an authenticated open redirect after state-changing POST requests, unauthenticated control over the session cookie path attribute, and link poisoning. The vulnerability does not allow CR/LF injection, so header splitting and cross-site scripting are not feasible.

The vulnerability allows an attacker with authentication to perform open redirects after POST requests, potentially redirecting users to malicious sites. Additionally, unauthenticated attackers can manipulate the session cookie path attribute, which may affect session handling and security. Poisoning of self-referential links could mislead users or affect application navigation. The inability to inject CR/LF characters limits the attacker's ability to perform header splitting or XSS attacks.

No official patch or remediation level is currently confirmed. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, administrators should consider restricting or validating the X-Forwarded-Prefix header at the proxy or application level to ensure it originates from trusted sources and contains only safe values.