CVE-2026-63771Patch

LOWCVSS 6.0 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

Patch affected systems immediately

Recommended action window: Monitor and triage in normal cycle

NVD description

Adminer before 5.4.3 contains a cookie injection vulnerability that allows attackers to manipulate cookie attributes by injecting arbitrary values through the unsanitized X-Forwarded-Prefix HTTP header used in Set-Cookie path attributes. Attackers can exploit a misconfigured reverse proxy to downgrade SameSite protection and enable cross-origin authenticated requests, bypassing cookie security controls.

Back to dashboard

0.5/ 10 priority

Sources & remediation

Other references

Weakness type (CWE)

CWE-113

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Threat summary

Patch or workaround signal is available
1 mentions across 1 observed day

What's happening

Patch or workaround mentioned in 1 signal
Technical details provided in 1 signal
1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d

Signal classification1 categories

Patch

1100.0%

Referenced assets1 URL

By indicator

https://www.valtersit.com/cve/CVE-2026-63771/

Full discourse1 post

Hugo | DevOps | Cybersecurity 🇱🇻@HugoValters92d
Patch
#CVE-2026-63771 - Cookie #injection in Adminer <5.4.3. X-Forwarded-Prefix header abuse downgrades SameSite, enabling cross-origin auth bypass. #CVSS 7.1. Update or mitigate immediately. #CVEAlert #Adminer #infosec #devsecops #devops #developer #git #github #gitlab https://www.valtersit.com/cve/CVE-2026-63771/
Post summary
A new vulnerability (CVE-2026-63771) in Adminer <5.4.3 is disclosed, involving a SameSite downgrade via X-Forwarded-Prefix header abuse that allows cross-origin auth bypass; users are urged to update or mitigate immediately.
0000074
986 followersView on X

Explore more

Back to dashboard