Adminer before version 5.4.3 contains a flaw that allows attackers to inject arbitrary values through the X-Forwarded-Prefix header, which the application uses unsanitized to compose Set-Cookie path attributes. By manipulating cookie attributes such as SameSite, Secure, and Path, an attacker can downgrade cookie protection and allow cross‑origin requests that carry an authenticated session. Based on the description, this can lead to credential theft or session hijacking.

The vulnerability affects the open‑source Adminer tool from vendor vrana. All releases prior to 5.4.3 are impacted, so administrators should verify whether their deployment uses a legacy Adminer version and whether any reverse proxy forwards the X-Forwarded-Prefix header without validation.

The CVSS score is 6, indicating moderate severity. The EPSS score is less than 1%, showing a very low current probability of exploitation, and the flaw is not listed in the CISA KEV catalog. Exploitation requires an attacker to inject a malicious X-Forwarded‑Prefix header, typically achievable through a misconfigured reverse proxy that forwards client headers unchecked. No local code execution is needed, and the attack can be performed remotely via normal HTTP traffic, potentially compromising the confidentiality and integrity of user sessions.