AdminNeo: Cookie attribute injection via X-Forwarded-Prefix (CVE-2026-96631)

AdminNeo versions 4.6.0 through 5.5.0 are vulnerable to cookie attribute injection via the X-Forwarded-Prefix HTTP header. The application fails to sanitize this user-supplied header before concatenating it into the REQUEST_URI and subsequently using it to construct Set-Cookie response headers. An attacker can inject arbitrary cookie attributes, such as Domain, Path, and SameSite, which are then parsed and executed by the victim's browser. This flaw impacts the neo_sid (session ID) and neo_key (database password encryption key) cookies.

This issue is tracked as CVE-2026-96631.

Impact

Successful exploitation allows for session hijacking of the neo_sid cookie and potential theft of the neo_key cookie, which is used to encrypt database credentials. An attacker can force the browser to send these cookies to an attacker-controlled domain by injecting a Domain attribute (e.g., Domain=.evil.com).

Recommendation

• Upgrade to AdminNeo version 5.5.1 or later immediately.
• If immediate patching is not possible, modify the reverse proxy configuration to strip the X-Forwarded-Prefix header from client requests or force it to a static, trusted value.
• Implement a WAF rule to block HTTP requests containing semicolons or other metacharacters in the X-Forwarded-Prefix header.