CVE-2026-63771 describes a cookie injection vulnerability in Adminer before version 5.4.3. The vulnerability arises from improper neutralization of CRLF sequences in HTTP headers, specifically the unsanitized use of the X-Forwarded-Prefix header in Set-Cookie path attributes. An attacker can exploit this by injecting arbitrary values, potentially downgrading SameSite cookie protections and enabling cross-origin authenticated requests. Exploitation depends on the presence of a misconfigured reverse proxy. The CVSS 4.0 score is 6.0, indicating medium severity. No vendor advisory or patch information is currently available.

Attackers can manipulate cookie attributes by injecting arbitrary values into the Set-Cookie path attribute via the unsanitized X-Forwarded-Prefix header. This manipulation can downgrade SameSite cookie protections, allowing cross-origin authenticated requests that bypass cookie security controls. The vulnerability requires a misconfigured reverse proxy to be exploitable, limiting the attack surface. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, review and correct reverse proxy configurations to ensure they do not forward or allow manipulation of the X-Forwarded-Prefix header. Consider implementing additional validation or sanitization of HTTP headers at the application or proxy level to mitigate injection risks.