AdminNeo has Cookie Attribute Injection via Unsanitized X-Forwarded-Prefix in Set-Cookie Headers

Summary AdminNeo versions 4.6.0 through at least 5.5.0 are vulnerable to cookie attribute injection via the X-Forwarded-Prefix HTTP header. An attacker who can influence this header (e.g., through a reverse proxy that forwards it from clients, an attacker-controlled upstream proxy, or a man-in-the-middle position) can inject arbitrary cookie attributes including Domain, Path, Secure, and SameSite into all Set-Cookie response headers emitted by AdminNeo. This allows an attacker to expand the cookie scope to an attacker-controlled domain (e.g., Domain=.evil.com), causing the victim's browser to send AdminNeo's neosid (session ID) and neokey (database password encryption key) cookies to the attacker's server on subsequent requests. Originally reported by @retkoussa in Adminer: https://github.com/vrana/adminer/security/advisories/GHSA-c533-9qwm-8w5h Vulnerable Code Root cause 1 - Unsanitized header prepended to REQUESTURI (admin/include/bootstrap.inc.php, lines 50–52): php if ($SERVER["HTTPXFORWARDEDPREFIX"]) { $SERVER["REQUESTURI"] = $SERVER["HTTPXFORWARDEDPREFIX"] . $SERVER["REQUESTURI"]; } The client-supplied X-Forwarded-Prefix header is concatenated into REQUESTURI with no…

curl https://cve.zerocrew.in/api/cve/CVE-2026-96631