CVE-2026-63771 Adminer < 5.4.3 Cookie Injection via X-Forwarded-Prefix Header
Attackers can bypass SameSite cookie protections in Adminer by injecting values via the X-Forwarded-Prefix header, enabling cross-origin authenticated requests.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-63771?
CVE-2026-63771 is a medium-severity vulnerability in vrana adminer, published on 20 Jul 2026. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Adminer before 5.4.3 contains a cookie injection vulnerability that allows attackers to manipulate cookie attributes by injecting arbitrary values through the unsanitized X-Forwarded-Prefix HTTP header used in Set-Cookie path attributes. Attackers can exploit a misconfigured reverse proxy to downgrade SameSite protection and enable cross-origin authenticated requests, bypassing cookie security controls.
Weakness: CWE-113
Which versions are affected by CVE-2026-63771?
How do I fix CVE-2026-63771?
Upgrade to a fixed version.
Is CVE-2026-63771 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-63771 exists.
Sources
Also known as DEBIAN-CVE-2026-63771, GHSA-c533-9qwm-8w5h, GHSA-hvv2-8jpj-gr8h, UBUNTU-CVE-2026-63771.