CVE-2026-34959 Adminer before 5.5.0 Open Redirect via X-Forwarded-Prefix
Attackers can exploit unvalidated X-Forwarded-Prefix headers to redirect users to malicious sites or manipulate session cookies in Adminer.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-34959?
CVE-2026-34959 is a medium-severity vulnerability in vrana adminer, published on 25 Aug 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Adminer 4.6.0 before 5.5.0 prepends the client-supplied X-Forwarded-Prefix header to $_SERVER["REQUEST_URI"] with no trusted-proxy check and no validation of the prefix value. An attacker can supply an absolute URL (e.g. X-Forwarded-Prefix: https://evil.example) that flows into Location redirect headers, the Set-Cookie path attribute, and self-referential links. This enables an authenticated open redirect after state-changing POSTs, unauthenticated control of the session cookie path attribute, and poisoning of self-referential links; CR/LF cannot be injected, so header splitting/XSS is not possible.
Weakness: CWE-20
Which versions are affected by CVE-2026-34959?
How do I fix CVE-2026-34959?
Upgrade to a fixed version.
Is CVE-2026-34959 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-34959 exists.
Sources
Also known as DEBIAN-CVE-2026-34959, GHSA-8478-xrj3-h9c2, GHSA-fh9x-8h7v-rwhv, UBUNTU-CVE-2026-34959.