CVE-2026-63771 describes a cookie injection vulnerability in Adminer before version 5.4.3. The issue stems from the unsanitized use of the X-Forwarded-Prefix HTTP header in setting cookie path attributes. An attacker exploiting a misconfigured reverse proxy can inject arbitrary values, manipulating cookie attributes such as SameSite flags. This allows bypassing of cookie security controls, potentially enabling cross-origin authenticated requests. The vulnerability is categorized as HTTP request/response splitting due to improper neutralization of CRLF sequences in HTTP headers.

Attackers can manipulate cookie attributes by injecting arbitrary values via the X-Forwarded-Prefix header, potentially downgrading SameSite cookie protections. This enables cross-origin authenticated requests, which may lead to unauthorized actions performed in the context of an authenticated user. The vulnerability requires a misconfigured reverse proxy to be exploitable and involves partial user interaction (UI:P).

No official patch or fix is currently confirmed for this vulnerability. Users should monitor the vendor's advisory for updates regarding remediation. In the meantime, reviewing reverse proxy configurations to ensure proper sanitization of HTTP headers and avoiding reliance on unsanitized X-Forwarded-Prefix headers in cookie attributes may reduce risk.