CVE-2026-34959: Improper Input Validation in vrana adminer

CVE-2026-34959 describes an improper input validation vulnerability in Adminer versions >=4.6.0 and <5.5.0. The application prepends the X-Forwarded-Prefix HTTP header directly to the $_SERVER["REQUEST_URI"] variable without verifying if the header originates from a trusted proxy or validating the prefix value. An attacker can supply an absolute URL in this header, which then propagates into Location redirect headers, the Set-Cookie path attribute, and self-referential links. This leads to an authenticated open redirect after state-changing POST requests, unauthenticated control over the session cookie path attribute, and poisoning of self-referential links. The vulnerability does not permit CR/LF injection, so header splitting and XSS attacks are not possible.

The vulnerability allows attackers to perform open redirects after authenticated POST requests, potentially redirecting users to malicious sites. It also enables unauthenticated attackers to control the session cookie path attribute, which could affect cookie scope and session management. Additionally, self-referential links can be poisoned, potentially misleading users or affecting application behavior. However, the inability to inject CR/LF characters prevents header splitting and cross-site scripting attacks.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should avoid exposing Adminer instances to untrusted networks or ensure that the X-Forwarded-Prefix header is sanitized or stripped by upstream proxies. Monitoring and restricting access to trusted proxies can help mitigate exploitation risks.