{"id":"CVE-2026-34959","title":"Adminer 4.6.0 before 5.5.0 prepends the client-supplied X-Forwarded-Prefix header to $_SERVER[\"REQUEST_URI\"] with no trusted-proxy check and no validation of the prefix value","summary":"Adminer 4.6.0 before 5.5.0 prepends the client-supplied X-Forwarded-Prefix header to $_SERVER[\"REQUEST_URI\"] with no trusted-proxy check and no validation of the prefix value. An attacker can supply an absolute URL (e.g. X-Forwarded-Pref…","severity":"medium","cvss":4.7,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:L/A:N","cwe":["CWE-20"],"published":"2026-08-25","updated":"2026-09-08","sourceUpdated":"2026-09-08T20:23:49.880","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-34959","references":[{"url":"https://github.com/vrana/adminer/security/advisories/GHSA-8478-xrj3-h9c2","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/adminer-before-open-redirect-via-x-forwarded-prefix","label":"disclosure@vulncheck.com"},{"url":"https://github.com/vrana/adminer/security/advisories/GHSA-8478-xrj3-h9c2","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd"],"epss":0.0029,"epssPercentile":0.19172,"ingestedAt":"2026-09-08T21:11:12.285Z","slug":"CVE-2026-34959","body":"## Overview\n\nAdminer 4.6.0 before 5.5.0 prepends the client-supplied X-Forwarded-Prefix header to $_SERVER[\"REQUEST_URI\"] with no trusted-proxy check and no validation of the prefix value. An attacker can supply an absolute URL (e.g. X-Forwarded-Prefix: https://evil.example) that flows into Location redirect headers, the Set-Cookie path attribute, and self-referential links. This enables an authenticated open redirect after state-changing POSTs, unauthenticated control of the session cookie path attribute, and poisoning of self-referential links; CR/LF cannot be injected, so header splitting/XSS is not possible.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":26,"depthScoreParts":{"impact":25.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}