{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/adminneo--4.6.0--5.5.1/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:adminneo:adminneo:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-96631"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["AdminNeo (\u003e= 4.6.0, \u003c 5.5.1)"],"_cs_severities":["high"],"_cs_tags":["web-vulnerability","cve","cookie-injection"],"_cs_type":"advisory","_cs_vendors":["AdminNeo"],"content_html":"\u003cp\u003eAdminNeo versions 4.6.0 through 5.5.0 are vulnerable to cookie attribute injection via the \u003ccode\u003eX-Forwarded-Prefix\u003c/code\u003e HTTP header. The application fails to sanitize this user-supplied header before concatenating it into the \u003ccode\u003eREQUEST_URI\u003c/code\u003e and subsequently using it to construct \u003ccode\u003eSet-Cookie\u003c/code\u003e response headers. An attacker can inject arbitrary cookie attributes, such as \u003ccode\u003eDomain\u003c/code\u003e, \u003ccode\u003ePath\u003c/code\u003e, and \u003ccode\u003eSameSite\u003c/code\u003e, which are then parsed and executed by the victim's browser. This flaw impacts the \u003ccode\u003eneo_sid\u003c/code\u003e (session ID) and \u003ccode\u003eneo_key\u003c/code\u003e (database password encryption key) cookies.\u003c/p\u003e\n\u003cp\u003eThis issue is tracked as CVE-2026-96631.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for session hijacking of the \u003ccode\u003eneo_sid\u003c/code\u003e cookie and potential theft of the \u003ccode\u003eneo_key\u003c/code\u003e cookie, which is used to encrypt database credentials. An attacker can force the browser to send these cookies to an attacker-controlled domain by injecting a \u003ccode\u003eDomain\u003c/code\u003e attribute (e.g., \u003ccode\u003eDomain=.evil.com\u003c/code\u003e).\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade to AdminNeo version 5.5.1 or later immediately.\u003c/li\u003e\n\u003cli\u003eIf immediate patching is not possible, modify the reverse proxy configuration to strip the \u003ccode\u003eX-Forwarded-Prefix\u003c/code\u003e header from client requests or force it to a static, trusted value.\u003c/li\u003e\n\u003cli\u003eImplement a WAF rule to block HTTP requests containing semicolons or other metacharacters in the \u003ccode\u003eX-Forwarded-Prefix\u003c/code\u003e header.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-11-01T08:46:38Z","date_published":"2026-11-01T08:46:38Z","id":"https://feed.craftedsignal.io/briefs/2026-11-adminneo-cookie-injection/","summary":"AdminNeo versions 4.6.0 through 5.5.0 contain a vulnerability where unsanitized X-Forwarded-Prefix headers allow cookie attribute injection, potentially leading to session hijacking and credential theft.","title":"AdminNeo: Cookie attribute injection via X-Forwarded-Prefix (CVE-2026-96631)","url":"https://feed.craftedsignal.io/briefs/2026-11-adminneo-cookie-injection/"}],"language":"en","title":"CraftedSignal Threat Feed - AdminNeo (\u003e= 4.6.0, \u003c 5.5.1)","version":"https://jsonfeed.org/version/1.1"}