CVE-2026-25892 HIGH

CVE-2026-25892: Adminer has an Unauthenticated Persistent DoS via Array Injection in ?script=version Endpoint

Vendor Vrana
Product adminer
Weakness CWE-20 · Input validation
Published February 9, 2026
Last update February 10, 2026
View on NVD All CVEs

CVSS base score

7.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

What the vulnerability does

01Description

Adminer is open-source database management software. Adminer v5.4.1 and earlier has a version check mechanism where adminer.org sends signed version info via JavaScript postMessage, which the browser then POSTs to ?script=version. This endpoint lacks origin validation and accepts POST data from any source. An attacker can POST version[] parameter which PHP converts to an array. On next page load, openssl_verify() receives this array instead of string and throws TypeError, returning HTTP 500 to all users. Upgrade to Adminer 5.4.2.

Key dates

02Disclosure timeline

February 9, 2026 CVE published
February 10, 2026 Record updated