AIKIDO-2026-768999
vrana/adminer is vulnerable to Open Redirect
47
Medium Risk
This Affects:
vrana/adminerTL;DR
Adminer's reverse-proxy support prepends the client-supplied X-Forwarded-Prefix header to REQUEST_URI on every request, with no trusted-proxy gate and no validation of the prefix value. Because the resulting URI flows into Location: redirects, the session cookie path attribute, and self-referential links, an externally supplied header value such as an absolute URL yields a fully externally controlled destination. This enables an open redirect on state-changing requests, pre-authentication control of the session-cookie path, and poisoning of self URLs, and the header is honoured even when Adminer is not behind a reverse proxy. The fix validates the header and ignores invalid X-Forwarded-Prefix values before using them.
Who does this affect?
You are affected if an instance on a version in the vulnerable range receives requests carrying an externally supplied X-Forwarded-Prefix header, which is honoured on every request even when Adminer is not deployed behind a reverse proxy and with no trusted-proxy gate. The session-cookie path attribute can be influenced pre-authentication, while the off-site open redirect requires a logged-in operator to follow a poisoned state-changing request, so redirect impact is gated on user interaction.
Background info
vrana/adminer is vulnerable to Open Redirect in versions 4.6.0 - 5.4.4.
How to fix this
Upgrade the vrana/adminer library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant