Adminer versions 5.5.1 through 6.0.1 incorrectly parse the login "server" field, treating any string that does not end with a numeric port as an empty port and causing the host string to be re‑parsed by the database client. This flaw lets an unauthenticated remote attacker craft an entry such as 127.0.0.1:80/x so that the server opens a TCP connection to an arbitrary host and privileged port before credentials are verified, creating a blind server‑side request forgery and internal port‑scanning capability.

The affected product is Adminer, published by vrana. Versions 5.5.1 up to and including 6.0.1 are vulnerable; the flaw was fixed in 6.0.2.

The CVSS score of 6.9 indicates a moderate severity. Exploitation requires only access to the Adminer login page and can be performed by any unauthenticated user. While no EPSS information is available, the lack of an official KEV listing suggests the vulnerability has not yet become a widely used exploit. Attackers can exploit the flaw to reach internal hosts and privileged ports, acting as a covert reconnaissance or foothold mechanism. The vulnerability does not depend on elevated privileges or special configuration beyond normal Adminer deployment.