PT-2026-61694 · Adminer · Adminer

George Chen · CVE-2026-63771 · Published 2026-07-20 · Updated 2026-07-20

Positive Technologies (AI Summary)

CVSS v3.1

7.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Adminer versions prior to 5.4.3

Description An issue exists where arbitrary values can be injected into cookie attributes via the unsanitized X-Forwarded-Prefix HTTP header, which is used in Set-Cookie path attributes. By exploiting a misconfigured reverse proxy, an attacker can downgrade SameSite protection to enable cross-origin authenticated requests and bypass cookie security controls.

Recommendations Update to version 5.4.3 or later.

Exploit

Fix

Weakness Enumeration

CWE-113

Related Identifiers

CVE-2026-63771

GHSA-C533-9QWM-8W5H

Affected Products

Adminer

References · 8

• 🔥 https://github.com/vrana/adminer/issues/1298 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63771.json · Exploit
• https://github.com/vrana/adminer/security/advisories/GHSA-c533-9qwm-8w5h · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2026-63771 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-63771 · Security Note
• https://github.com/vrana/adminer · Note
• https://github.com/vrana/adminer/releases#release-v5.4.3 · Note
• https://vulncheck.com/advisories/adminer-cookie-injection-via-x-forwarded-prefix-header · Note