AIKIDO-2026-550849

TL;DR

Adminer's bootstrap concatenates the client supplied X-Forwarded-Prefix header directly onto REQUEST_URI, and the cookie() helper embeds that unescaped value into the Set-Cookie path attribute. A semicolon in the header value injects extra cookie attributes such as Domain, Secure, and SameSite into the adminer_sid session and adminer_key database password cookies. Behind a reverse proxy or man-in-the-middle position, this widens the cookie scope to an untrusted domain so the cookies are sent there on later requests. The fix validates the header value before it reaches the cookie path attribute.