Adminer versions prior to 5.5.0 concatenate the client‑supplied X‑Forwarded‑Prefix header into the request URI without validating the value or checking that the request passed through a trusted proxy. An attacker can set the header to an absolute URL, such as https://evil.example, which then becomes part of Location redirect headers, the Set‑Cookie path attribute, and self‑referential links. This flaw allows an authenticated attacker to perform an open redirect after state‑changing POSTs, an unauthenticated attacker to modify the session cookie path, and to poison self‑referential links. The vulnerability does not permit CR/LF injection, so header splitting or XSS is not possible, but the impact on user navigation and session handling can be significant.

The affected product is Adminer by vrana. Vulnerable releases are all versions up to and including 4.6.x, with all releases before 5.5.0 susceptible to this flaw.

The CVSS score is 5.3, indicating a moderate risk. The EPSS score is not available, but the attack does not rely on zero‑day exploits or privileged access beyond the ability to supply the X‑Forwarded‑Prefix header, which can be done from an external client or by a compromised internal user. The vulnerability is not listed in the CISA KEV catalog. Attackers can achieve the impact without needing remote code execution or elevated privileges; the primary vector is a manipulated HTTP request that reaches the application.