The vulnerability is a pre‑authentication server‑side request forgery in the optional Elasticsearch driver of Adminer. It occurs because the driver is invoked before the user’s credentials are validated, allowing an unauthenticated attacker to supply a crafted auth[server] parameter that forces Adminer to issue an HTTP GET request via PHP’s file_get_contents to any reachable host and port. Because the driver only performs general syntax checks, it does not block loopback, private, link‑local, or reserved addresses, and defaults to port 9200 when none is provided. The driver then exposes selected JSON error fields from non‑2xx responses or connection failures on the login page, providing a useful port‑scanning oracle for internal network reconnaissance and service fingerprinting.

The flaw affects Adminer versions 4.16.0 through 6.0.1 when the optional Elasticsearch driver has been explicitly deployed, such as by including adminer/elastic.php or configuring an adminer_object() to load the driver. The vulnerability is present when the PHP setting allow_url_fopen is enabled. The affected vendor is vrana, product Adminer.

The CVSS score of 6.9 classifies the vulnerability as medium severity. Although EPSS data is unavailable, the lack of a KEV listing suggests no known exploitation activity. The attack is feasible against any publicly accessible Adminer instance that has the Elasticsearch driver installed and allow_url_fopen enabled; a single unauthenticated request to the login page can trigger the SSRF to target any internal host and return error information that enables port scanning and network enumeration. The vulnerability is described by CWE‑918 (Server‑Side Request Forgery).