CVE-2026-34964 is an SSRF vulnerability in Adminer prior to version 5.5.0. The flaw exists in the login form's server field validator, which inadequately validates port values by inspecting only leading integers and failing to reject non-numeric ports. Attackers can exploit this by injecting PDO DSN keys (host= and port=) into the server parameter, circumventing privileged port restrictions and establishing TCP connections to arbitrary internal network hosts and ports without authentication.

An attacker can leverage this vulnerability to make the Adminer server initiate TCP connections to arbitrary internal hosts and ports, potentially accessing internal services or resources that are otherwise protected. This occurs before authentication, increasing the risk of unauthorized internal network access. The CVSS 4.0 score is 6.9 (medium severity), indicating a significant but not critical risk.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch information is provided at this time. Until a fix is available, restrict access to Adminer instances and monitor for suspicious activity related to server parameter manipulation.