Flaws in AdminNeo Expose Database Sessions to Hijacking and Request Forgery

Key facts

Public disclosure records cataloged by VulDB indicate that security researchers evaluated AdminNeo's internal session validation mechanisms and uncovered two separate implementation flaws within its primary functions file, functions.inc.php.

The first documented issue, cataloged under CVE-2026-96631, involves improper session state management through browser cookies. In standard web security architectures, an application must regenerate its session identifier upon any change in privilege level—most critically when an anonymous visitor successfully authenticates as an administrative user. When an application fails to invalidate or re-issue session tokens across authentication boundaries, a condition known as session fixation occurs. In AdminNeo, the cookie handling routines within functions.inc.php permit session identifiers to persist, enabling an unauthorized party to pre-determine or maintain control over an active session identifier once a legitimate user logs in.

The second issue, registered as CVE-2026-96629, directly compromises transaction authenticity within the tool's interface. The flaw was located in the verify_token component of functions.inc.php, the function responsible for validating cross-site request forgery (CSRF) tokens. CSRF protection relies on generating unpredictable, user-specific tokens that accompany administrative state-changing requests, such as altering configuration settings, executing database queries, or dropping tables. Vulnerabilities within the token verification routine allow requests crafted by external third parties to bypass verification, tricking the application into processing arbitrary commands on behalf of an authenticated operator.

According to VulDB, both disclosures identify software versions up to 5.5.0 as containing the vulnerable logic. While the exact methodology used to discover the weaknesses was not detailed in the brief initial alerts, the identification of precise function names points to source-code analysis or targeted fuzzing against the application's core request-handling pipelines.

Why it matters

Web-based database management utilities occupy an exceptionally sensitive position within modern application infrastructure. Because utilities like AdminNeo are designed to interact directly with backend storage engines, an attacker who compromises the tool effectively gains root-level access to the data layer. In enterprise, hosting, and developer environments, these databases often store sensitive customer records, financial ledgers, system credentials, and confidential intellectual property.

Session fixation presents a critical danger because it sidesteps standard password complexity and multi-factor protections. If an attacker can force an administrator's browser to adopt a known session identifier prior to authentication—whether via link manipulation, network eavesdropping, or local cookie manipulation—the attacker can inherit the administrator's fully authenticated session immediately after the user signs in. This permits complete impersonation without ever discovering the target's underlying database credentials.

Cross-site request forgery amplifies this operational risk. Administrative panels are prized targets for CSRF attacks because administrators routinely leave their management dashboards open in background browser tabs while browsing the broader web. If an authenticated administrator visits a compromised or malicious webpage, embedded scripts can silently dispatch administrative commands directly to the AdminNeo interface. If the verify_token routine fails to validate tokens rigorously, the application may execute severe operations, including the creation of unauthorized database accounts, the exfiltration of table schemas, or the deletion of mission-critical production databases. The blast radius of such attacks extends beyond software downtime into data protection compliance liabilities, regulatory fines, and permanent data loss.

AdminNeo is an open-source web application designed as an agile, lightweight interface for managing databases, developed as a modern successor and fork within the lineage of Adminer. Adminer, originally developed by Czech software engineer Jakub Vrána under the name phpMinAdmin beginning in 2007, was conceived as an alternative to the heavyweight and historically vulnerability-prone phpMyAdmin. Unlike phpMyAdmin, which consists of thousands of individual files and complex dependency chains, Vrána pioneered an architecture centered on packaging the entire tool into a single PHP script. This architectural decision made Adminer exceptionally popular among systems administrators, web hosts, and freelance developers seeking rapid deployment on remote servers without requiring complex package installation procedures.

However, the minimalist single-file or reduced-footprint approach presents distinct security maintenance challenges. Core functions—including session handling, token creation, query rendering, and driver abstraction—are frequently consolidated into shared helper scripts such as functions.inc.php. Over the past two decades, web management utilities have repeatedly faced vulnerabilities surrounding authentication bypasses, cross-site scripting (XSS), server-side request forgery (SSRF), and CSRF.

Adminer itself experienced high-profile security disclosures in past years, including CVE-2021-43008, which involved arbitrary file disclosure, alongside earlier issues where default configurations exposed local databases to remote connections. The fork and continued development under projects like AdminNeo sought to maintain the software's lightweight ethos while modernizing compatibility with newer PHP releases and evolving web standards. Despite these modernizations, foundational web application logic—particularly state preservation and cryptographic token comparison—remains prone to subtle design errors if developers rely on legacy verification patterns rather than hardened modern framework primitives.

Reaction

At the time of disclosure, formal public responses from the software maintainers have not been released across main distribution channels. The disclosures appeared via vulnerability aggregation feeds without accompanying press statements or simultaneous advisory notes on major social coding repositories.

Security maintainers and community contributors to open-source database tools typically address such reports by issuing pull requests, drafting patch releases, and publishing security advisories via platforms such as GitHub. Downstream system maintainers—such as Linux distribution package curators, Docker container maintainers, and web control panel developers—have yet to issue synchronized downstream advisories. Because database tools are frequently deployed as ad-hoc standalone scripts rather than through centralized package managers, security experts expect downstream remediation to depend heavily on manual awareness campaigns and self-hosted administrative updates rather than automated fleet-wide patching.

What we don't know yet

Several technical details remain unconfirmed in the initial vulnerability documentation. The reporting by VulDB does not provide complete Common Vulnerability Scoring System (CVSS) vector strings or finalized base scores for either CVE-2026-96631 or CVE-2026-96629, leaving the formal standardized severity rating pending. Furthermore, the records do not indicate whether active exploitation has been observed in production environments or whether functional proof-of-concept exploit code has been circulating among threat actors.

It is also unclear whether an official upstream update, such as a version 5.5.1 release, has been finalized to remediate both issues simultaneously. The exact attack prerequisites also require clarification: specifically, whether the CSRF defect in verify_token stems from a total failure to validate tokens, an improper comparison algorithm susceptible to timing attacks, or the acceptance of empty or improperly formatted tokens. The answers to these questions will determine the ease with which an external attacker can orchestrate automated attacks against targeted deployments.

What to watch

Administrators and organizations running AdminNeo installations should monitor several key milestones over the coming days. The primary indicator will be the publication of formal patch notes or a version release exceeding 5.5.0 within the project's official source code repository, which will provide code diffs clarifying the exact fixes within functions.inc.php.

In the absence of an immediate official update, security personnel should verify whether defensive mitigations are possible at the web server and network perimeter levels. Relevant controls include restricting network access to administrative portals through internal virtual private networks (VPNs) or IP allowlists, preventing the dashboard from facing the open internet. Administrators should also configure explicit SameSite cookie attributes (such as SameSite=Strict) on web server session headers to mitigate cross-site request forgery, while ensuring that session regeneration is enforced at the PHP runtime level. Finally, tracking the National Vulnerability Database (NVD) for formal CVSS severity scores and technical analysis will provide definitive benchmarks for organizational patch prioritization.

Reporting for this article was based on security vulnerability disclosures published by VulDB.