Adminer v5.4.1 and earlier lack origin validation on the ?script=version endpoint. An attacker can submit a POST request containing a 'version[]' parameter, which PHP interprets as an array. When openssl_verify() later receives this array instead of a string, it raises a TypeError and triggers an HTTP 500 response for all users. This results in a persistent, unauthenticated denial of service, compromising availability without affecting confidentiality or integrity.

The vulnerability affects Adminer versions 5.4.1 and earlier, developed by vrana. Systems running these versions of the open‑source database management tool are vulnerable, regardless of deployment size or environment, because the flaw is in unguarded code that all installations share.

With a CVSS score of 7.5, the flaw is considered high severity. An EPSS score of 5% indicates a moderate likelihood that an adversary will exploit it. The vulnerability is not listed in CISA’s KEV catalog. An attacker can trigger the DoS remotely by sending a crafted POST to the susceptible endpoint; no authentication or privileges are required, making the attack straightforward for any web host exposing Adminer.