AdminNeo: CSRF Token Secret Recoverable from Single Observed Token, Enabling Cross-Site Request Forgery
CVE-2026-96629
Summary AdminNeo's CSRF protection uses a BREACH-resistant XOR masking scheme, but the implementation transmits both the XOR mask and the masked value in every token. This allows any observer who sees a single CSRF token (via network sniffing, log files, Referrer header, or XSS) to instantly recover the session secret and forge unlimited valid CSRF tokens. Additionally, the underlying session token has only ~20 bits of entropy (rand(1, 1e6)), making blind brute-force feasible even without token observation. Originally reported by @az0mb13 in Adminer: [GHSA-q4f2-39gr-45jh](https://github.com/vrana/adminer/security/advisories/GHSA-33j4-hc95-pggg) Details Token generation in admin/include/functions.inc.php lines 1181-1184: php function gettoken() { $rand = rand(1, 1e6); return ($rand ^ $SESSION["token"]) . ":$rand"; } Token verification in lines 1189-1192: php function verifytoken() { list($token, $rand) = explode(":", $POST["token"]); return ($rand ^ $SESSION["token"]) == $token; } Session token initialized in admin/include/auth.inc.php lines 327 and 385: php $SESSION["token"] = rand(1, 1e6); Three distinct weaknesses: 1. Instant recovery: The token format (rand XOR secret):rand…
Assessment
- CVSS
- 6.8 (v3.1)
- Severity
- Medium
- Known exploited
- Not listed in CISA KEV
- Exploit availability
- Nothing found in Exploit-DB, Metasploit, Nuclei or public PoC repositories
- Published
- 30 October 2026
- Last updated
- 30 October 2026
- Affected
- composer · adminneo-org/adminneo
- Weakness
- CWE-330, CWE-352
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H
At the source
References
Community proofs of concept
No community proof of concept yet. If you have one for a published vulnerability and the right to share it, add it below — it will appear here once reviewed.
Submit a proof of concept
Only for publicly disclosed vulnerabilities, and only material from testing you were authorised to perform. This platform does not buy, sell, or broker exploits — see earning from vulnerability research for legitimate bounty programs. Submissions are reviewed before they appear. Text only; do not include live credentials, personal data, or anything targeting systems you are not permitted to test.
Query this programmatically
Agents can read this through the MCP endpoint, or over HTTP:
curl https://cve.zerocrew.in/api/cve/CVE-2026-96629