Vulnerability · Published Jul 20, 2026 · Assigned by VulnCheck

CVE-2026-63771Adminer < 5.4.3 Cookie Injection via X-Forwarded-Prefix Header

High 7.1

In plain English

A high-severity security flaw in adminer from vrana. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.1High

Exploit odds (30 days)0.4%top 62.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Adminer before 5.4.3 contains a cookie injection vulnerability that allows attackers to manipulate cookie attributes by injecting arbitrary values through the unsanitized X-Forwarded-Prefix HTTP header used in Set-Cookie path attributes. Attackers can exploit a misconfigured reverse proxy to downgrade SameSite protection and enable cross-origin authenticated requests, bypassing cookie security controls.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	adminer	no fix listed	DEBIAN-CVE-2026-63771
Debian:13	adminer	no fix listed	DEBIAN-CVE-2026-63771
Debian:14	adminer	5.4.3+dfsg-1	DEBIAN-CVE-2026-63771
Ubuntu:22.04:LTS	adminer	no fix listed	UBUNTU-CVE-2026-63771
Ubuntu:24.04:LTS	adminer	no fix listed	UBUNTU-CVE-2026-63771
Ubuntu:26.04:LTS	adminer	no fix listed	UBUNTU-CVE-2026-63771
Ubuntu:26.10	adminer	no fix listed	UBUNTU-CVE-2026-63771

Affected products (as reported)

Vendor	Product	Versions
vrana	adminer	0 – before 5.4.3

Weakness: CWE-113 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

References

Researcher Disclosure technical-description, exploit, issue-tracking
GitHub Security Advisory (GHSA-c533-9qwm-8w5h) vendor-advisory
Release Notes release-notes
https://www.vulncheck.com/advisories/adminer-cookie-injection-via-x-forwarded-prefix-header third-party-advisory