{"items":[{"id":"NVI-00004310","kind":"vulnerability","title":"AdminNeo has Cookie Attribute Injection via Unsanitized X-Forwarded-Prefix in Set-Cookie Headers","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-79wv-8rh2-9vp2","CVE-2026-96631"],"plain_summary":"GitHub lists this reviewed advisory for adminneo-org/adminneo. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-59bc166e6857e39a18d0a8529393e216"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 5.5.1 for adminneo-org/adminneo. Confirm the publisher’s latest guidance.","source_ids":["sr-61128b26984d78e537b32dd8cde93074"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-10-30T22:52:48.000Z","value":"8.2 high","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-59bc166e6857e39a18d0a8529393e216"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-59bc166e6857e39a18d0a8529393e216","url":"https://github.com/advisories/GHSA-79wv-8rh2-9vp2","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-79wv-8rh2-9vp2","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T21:55:49.621Z"},{"id":"sr-61128b26984d78e537b32dd8cde93074","url":"https://github.com/advisories/GHSA-79wv-8rh2-9vp2","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-79wv-8rh2-9vp2","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:41:59.947Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-59bc166e6857e39a18d0a8529393e216"],"technology":"adminneo-org/adminneo","known_exclusions":[],"conditions_summary":"### Summary\n\nAdminNeo versions 4.6.0 through at least 5.5.0 are vulnerable to cookie attribute injection via the `X-Forwarded-Prefix` HTTP header. An attacker who can influence this header (e.g., through a reverse proxy that forwards it from clients, an attacker-controlled upstream proxy, or a man-in-the-middle position) can inject arbitrary cookie attributes including `Domain`, `Path`, `Secure`, and `SameSite` into all `Set-Cookie` response headers emitted by AdminNeo.\n\nThis allows an attacker to expand the cookie scope to an attacker-controlled domain (e.g., `Domain=.evil.com`), causing the victim's browser to send AdminNeo's `neo_sid` (session ID) and `neo_key` (database password encryption key) cookies to the attacker's server on subsequent requests.\n\nOriginally reported by @retkoussa in Adminer: https://github.com/vrana/adminer/security/advisories/GHSA-c533-9qwm-8w5h\n\n### Vulnerable Code\n\n**Root cause 1 - Unsanitized header prepended to `REQUEST_URI`**\n(`admin/include/bootstrap.inc.php`, lines 50–52):\n\n```php\nif ($_SERVER[\"HTTP_X_FORWARDED_PREFIX\"]) {\n\t$_SERVER[\"REQUEST_URI\"] = $_SERVER[\"HTTP_X_FORWARDED_PREFIX\"] . $_SERVER[\"REQUEST_URI\"];\n}\n```\n\nThe client-supplied `X-Forward","public_affected_ranges":[">= 4.6.0, < 5.5.1"]},{"certainty":"source_listed","source_ids":["sr-61128b26984d78e537b32dd8cde93074"],"technology":"adminneo-org/adminneo","known_exclusions":[],"conditions_summary":"### Summary\n\nAdminNeo versions 4.6.0 through at least 5.5.0 are vulnerable to cookie attribute injection via the `X-Forwarded-Prefix` HTTP header. An attacker who can influence this header (e.g., through a reverse proxy that forwards it from clients, an attacker-controlled upstream proxy, or a man-in-the-middle position) can inject arbitrary cookie attributes including `Domain`, `Path`, `Secure`, and `SameSite` into all `Set-Cookie` response headers emitted by AdminNeo.\n\nThis allows an attacker to expand the cookie scope to an attacker-controlled domain (e.g., `Domain=.evil.com`), causing the victim's browser to send AdminNeo's `neo_sid` (session ID) and `neo_key` (database password encryption key) cookies to the attacker's server on subsequent requests.\n\nOriginally reported by @retkoussa in Adminer: https://github.com/vrana/adminer/security/advisories/GHSA-c533-9qwm-8w5h\n\n### Vulnerable Code\n\n**Root cause 1 - Unsanitized header prepended to `REQUEST_URI`**\n(`admin/include/bootstrap.inc.php`, lines 50–52):\n\n```php\nif ($_SERVER[\"HTTP_X_FORWARDED_PREFIX\"]) {\n\t$_SERVER[\"REQUEST_URI\"] = $_SERVER[\"HTTP_X_FORWARDED_PREFIX\"] . $_SERVER[\"REQUEST_URI\"];\n}\n```\n\nThe client-supplied `X-Forward","public_affected_ranges":["ECOSYSTEM: introduced 4.6.0; fixed 5.5.1"]}],"null_published_at":"2026-10-31T22:13:27.125Z","source_updated_at":"2026-10-30T22:52:48.000Z","source_disclosed_at":"2026-10-30T22:52:47.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-10-31T21:41:59.947Z"}],"next_cursor":null,"snapshot_revision":"42594"}