CVE-2026-100698

Adminer before 6.0.2 Privileged-Port SSRF via host_port Regex

View on CVE.org
Published Sep 26, 2026 CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed
Description
Adminer 5.5.1 through 6.0.1 improperly parses the login 'server' string in the host_port() function in adminer/include/functions.inc.php. The port capture group requires pure digits anchored to the end of the string, so any server value with a non-digit tail fails the regex and falls back to returning the whole string as the host with an empty port. Because the privileged-port restriction in adminer/include/auth.inc.php inspects only the parsed port, the check is skipped, and the mysqli/mysqlnd client subsequently re-parses host:port from the host string and opens a TCP connection. A remote, unauthenticated attacker who can reach the Adminer login page can submit a crafted value such as 127.0.0.1:80/x to make the server initiate TCP connections to arbitrary internal hosts and privileged ports before credentials are validated, enabling server-side request forgery and blind internal port scanning (connection refused vs. handshake vs. timeout acts as a liveness oracle). This is a regression that re-opens the bypass fixed in 5.5.0 (GHSA-58cq-mgw2-38m5). Fixed in 6.0.2.

Analysis

AI-generated

Technical impact

Adminer versions 5.5.1 through 6.0.1 incorrectly parse the login "server" field, treating any string that does not end with a numeric port as an empty port and causing the host string to be re‑parsed by the database client. This flaw lets an unauthenticated remote attacker craft an entry such as 127.0.0.1:80/x so that the server opens a TCP connection to an arbitrary host and privileged port before credentials are verified, creating a blind server‑side request forgery and internal port‑scanning capability.

Affected Systems

The affected product is Adminer, published by vrana. Versions 5.5.1 up to and including 6.0.1 are vulnerable; the flaw was fixed in 6.0.2.

Risk and Exploitability

The CVSS score of 6.9 indicates a moderate severity. Exploitation requires only access to the Adminer login page and can be performed by any unauthenticated user. While no EPSS information is available, the lack of an official KEV listing suggests the vulnerability has not yet become a widely used exploit. Attackers can exploit the flaw to reach internal hosts and privileged ports, acting as a covert reconnaissance or foothold mechanism. The vulnerability does not depend on elevated privileges or special configuration beyond normal Adminer deployment.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Adminer to at least version 6.0.2, which fixes the SSRF flaw.
  • If an immediate upgrade is not feasible, restrict the Adminer web interface to trusted networks or place it behind a firewall or reverse proxy that blocks outbound connections to internal hosts.
  • Verify that the privileged‑port restriction in auth.inc.php is correctly enabled, and consider disabling unnecessary privileged port access or adjusting configuration to avoid open ports during authentication.

Generated by OpenCVE AI on September 26, 2026 at 16:28 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Vrana
Vrana adminer
Vendors & Products Vrana
Vrana adminer
Type Values Removed Values Added
Description Adminer 5.5.1 through 6.0.1 improperly parses the login 'server' string in the host_port() function in adminer/include/functions.inc.php. The port capture group requires pure digits anchored to the end of the string, so any server value with a non-digit tail fails the regex and falls back to returning the whole string as the host with an empty port. Because the privileged-port restriction in adminer/include/auth.inc.php inspects only the parsed port, the check is skipped, and the mysqli/mysqlnd client subsequently re-parses host:port from the host string and opens a TCP connection. A remote, unauthenticated attacker who can reach the Adminer login page can submit a crafted value such as 127.0.0.1:80/x to make the server initiate TCP connections to arbitrary internal hosts and privileged ports before credentials are validated, enabling server-side request forgery and blind internal port scanning (connection refused vs. handshake vs. timeout acts as a liveness oracle). This is a regression that re-opens the bypass fixed in 5.5.0 (GHSA-58cq-mgw2-38m5). Fixed in 6.0.2.
Title Adminer before 6.0.2 Privileged-Port SSRF via host_port Regex
First Time appeared Adminer
Adminer adminer
Weaknesses CWE-918
CPEs cpe:2.3:a:adminer:adminer:*:*:*:*:*:*:*:*
Vendors & Products Adminer
Adminer adminer
References
Metrics cvssV3_1

{'score': 5.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N'}
Weaknesses
  • CWE-918

    Server-Side Request Forgery (SSRF)

Sources

Status
PUBLISHED
Assigner
VulnCheck
Published
Updated
Sep 30, 2026, 3:07 PM
Reserved
Sep 26, 2026, 2:39 AM

View source JSON

Updated
Sep 30, 2026, 3:07 PM

JSON

Status
Awaiting Analysis
Published
Sep 26, 2026, 2:16 PM
Modified
Sep 30, 2026, 4:17 PM

View source JSON

No data.

Updated
Sep 26, 2026, 9:45 PM

JSON