The vulnerability is an incomplete resolution of an earlier X-Forwarded-Prefix issue in Adminer. The code that validates the prefix only blocks values beginning with a double slash (//evil.com) but allows a backslash after the leading slash, such as /\evil.com. Browsers normalize backslashes to slashes, causing the normalised path to survive into REQUEST_URI and ultimately reach PHP’s cookie_path() function. This can alter the Set‑Cookie Path attribute in a way that shortens or expands the scope of cookies. The exploit requires that an attacker be able to inject an X‑Forwarded‑Prefix header, which is possible if a reverse proxy is misconfigured to pass that header from clients.

The affected products are vrana Adminer versions 4.6.0 through 5.5.0. The issue was addressed in version 5.5.1 and later.

The CVSS score for this vulnerability is 2.3, indicating low severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an environment where clients can set the X‑Forwarded‑Prefix header, such as a reverse proxy that forwards client headers without sanitisation. The attack is therefore limited to setups with an improperly configured proxy and likely results only in anomalous cookie scoping rather than full compromise.