Adminer versions prior to 5.4.3 use a CSRF token scheme that includes both an XOR mask and a masked secret in each token. An attacker who can observe a single CSRF token, for example by sniffing traffic, reading logs, a Referrer header, or via XSS, can execute a single XOR operation to recover the session secret. The recovered secret allows the attacker to forge unlimited valid tokens, complete cross‑site request forgery attacks, and execute arbitrary SQL queries against the database as an authenticated user.

The vulnerability affects all installations of Adminer v5.4.2 and earlier, as supplied by the vendor vrana. It applies to any deployment using the default session token implementation, regardless of the server environment or database backend.

The CVSS score of 6.1 signifies moderate severity, while the absence of an EPSS score reduces certainty about current exploitation prevalence. The vulnerability is not listed in CISA’s KEV catalog. The attack requires observation of a CSRF token or a low‑entropy brute‑force attack, both of which are feasible in many production environments. Once exploited, an attacker can perform CSRF against authenticated sessions and run unauthorized SQL commands.