Log in Start free

Vulnerability · Published Aug 25, 2026 · Assigned by VulnCheck

CVE-2026-56706Adminer before 5.4.3 CSRF Token Secret Recovery via XOR Masking

Medium 6.8

In plain English

A medium-severity weak randomness in adminer from vrana. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.8Medium
Exploit odds (30 days)0.4%top 64.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

Adminer before 5.4.3 uses a CSRF token scheme that transmits both the XOR mask and the masked value in every token (format (rand XOR secret):rand), allowing anyone who observes a single CSRF token (e.g., via network sniffing, log files, Referrer header, or XSS) to recover the session secret with a single XOR operation and forge unlimited valid tokens. The implementation is further weakened by a low-entropy session token (rand(1,1e6), ~20 bits) that permits blind brute-force, and by use of loose comparison (==) in token verification, enabling PHP type juggling. Exploitation enables cross-site request forgery against authenticated sessions, including execution of arbitrary SQL queries.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12adminerno fix listedDEBIAN-CVE-2026-56706
Debian:13adminerno fix listedDEBIAN-CVE-2026-56706
Debian:14adminer5.4.3+dfsg-1DEBIAN-CVE-2026-56706
Ubuntu:22.04:LTSadminerno fix listedUBUNTU-CVE-2026-56706
Ubuntu:24.04:LTSadminerno fix listedUBUNTU-CVE-2026-56706
Ubuntu:26.04:LTSadminerno fix listedUBUNTU-CVE-2026-56706

Affected products (as reported)

VendorProductVersions
vrana adminer 0 – before 5.4.3

Weakness: CWE-330 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H

References