CVE-2026-56706: Use of Insufficiently Random Values in vrana adminer

Adminer versions prior to 5.4.3 use a CSRF token scheme where each token includes both the XOR mask and the masked value in the format (rand XOR secret):rand. Because both components are transmitted, an attacker who observes a single token (via network sniffing, logs, Referrer headers, or XSS) can recover the session secret with a single XOR operation. The session token's low entropy (~20 bits from rand(1,1e6)) allows blind brute-force attacks. Additionally, the token verification uses loose comparison (==), enabling PHP type juggling attacks. Together, these weaknesses allow an attacker to forge unlimited valid CSRF tokens, facilitating cross-site request forgery against authenticated sessions, including the execution of arbitrary SQL queries.

Successful exploitation allows attackers to bypass CSRF protections by forging valid tokens, leading to cross-site request forgery attacks against authenticated users. This can result in unauthorized execution of arbitrary SQL queries, potentially compromising the database integrity and confidentiality.

A fix is available in Adminer version 5.4.3 and later. Users should upgrade to version 5.4.3 or newer to remediate this vulnerability. No additional mitigation is indicated in the vendor advisory.