CVE-2026-96631 | vrana AdminNeo up to 5.5.0 Cookie functions.inc.php cookie HTTP_X_FORWARDED_PREFIX session fixiation

October 31, 2026 Yanac

A vulnerability labeled as critical has been found in vrana AdminNeo up to 5.5.0. This impacts the function cookie of the file admin/include/functions.inc.php of the component Cookie Handler. Executing a manipulation of the argument HTTP_X_FORWARDED_PREFIX can lead to session fixiation.

This vulnerability is registered as CVE-2026-96631. It is possible to launch the attack remotely. No exploit is available.VulDB Recent EntriesRead More