CVE-2026-56706: medium-severity vulnerability in vrana adminer
Adminer before 5.4.3 CSRF Token Secret Recovery via XOR Masking
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.1epss 0.4%
Adminer before 5.4.3 uses a CSRF token scheme that transmits both the XOR mask and the masked value in every token (format (rand XOR secret):rand), allowing anyone who observes a single CSRF token (e.g., via network sniffing, log files, Referrer header, or XSS) to recover the session secret with a single XOR operation and forge unlimited valid tokens. The implementation is further weakened by a low-entropy session token (rand(1,1e6), ~20 bits) that permits blind brute-force, and by use of loose comparison (==) in token verification, enabling PHP type juggling. Exploitation enables cross-site request forgery against authenticated sessions, including execution of arbitrary SQL queries.
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N
Affected products
vrana · adminerRelated CVEs — vrana adminer
In the same product, most dangerous first.
CVE-2021-21311HIGHSSRF in adminerEPSS 98.5%KEVCVE-2021-29625HIGHXSS in doc_linkEPSS 9.6%CVE-2026-25892HIGHAdminer has an Unauthenticated Persistent DoS via Array Injection in ?script=version EndpointEPSS 1.7%CVE-2026-56703HIGHAdminer before 5.4.3 Remote Code Execution via SQLite VACUUM INTOEPSS 1.2%CVE-2026-56705CRITICALAdminer before 5.4.3 Remote Code Execution via MSSQL PDO DSN InjectionEPSS 0.9%CVE-2026-109347HIGHAdminer before 6.1.1 RCE via UTF-8 BOM SQLite ATTACH BypassEPSS 0.9%