CVE-2026-34959

Adminer 4.6.0 before 5.5.0 prepends the client-supplied X-Forwarded-Prefix header to $_SERVER["REQUEST_URI"] with no trusted-proxy check and no validation of the prefix value. An attacker can supply an absolute URL (e.g. X-Forwarded-Prefix: https://evil.example) that flows into Location redirect headers, the Set-Cookie path attribute, and self-referential links. This enables an authenticated open redirect after state-changing POSTs, unauthenticated control of the session cookie path attribute, and poisoning of self-referential links; CR/LF cannot be injected, so header splitting/XSS is not possible.

• CWE-20

• https://github.com/vrana/adminer/security/advisories/GHSA-8478-xrj3-h9c2
• https://www.vulncheck.com/advisories/adminer-before-open-redirect-via-x-forwarded-prefix
• https://github.com/vrana/adminer/security/advisories/GHSA-8478-xrj3-h9c2

Published

Aug 25, 2026

Last Modified

Sep 8, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-34951Workbench is a suite of tools for administrators and develop…6.1
• CVE-2026-34952PraisonAI is a multi-agent teams system. Prior to version 4.…9.1
• CVE-2026-34953PraisonAI is a multi-agent teams system. Prior to version 4.…9.1
• CVE-2026-34954PraisonAI is a multi-agent teams system. Prior to version 1.…8.6
• CVE-2026-34955PraisonAI is a multi-agent teams system. Prior to version 4.…10
• CVE-2026-34956A flaw was found in Open vSwitch. When Open vSwitch is confi…5.9
• CVE-2026-3496The JetBooking plugin for WordPress is vulnerable to SQL Inj…7.5
• CVE-2026-34960barebox prior to version 2026.04.0 contains an out-of-bounds…7.1
• CVE-2026-34961barebox prior to version 2026.04.0 contains out-of-bounds re…7.7
• CVE-2026-34962barebox version prior to 2026.04.0 contains a denial-of-serv…5.5
• CVE-2026-34963barebox version prior to 2026.04.0 contains multiple memory-…7.8
• CVE-2026-34964Adminer before 5.5.0 contains a server-side request forgery …5.8