CVE-2026-25892

CVE-2026-25892 describes an unauthenticated denial-of-service vulnerability affecting Adminer versions 5.4.1 and earlier. This flaw stems from improper origin validation in the version check mechanism, allowing an attacker to send a crafted POST request to the ‘?script=version’ endpoint. By supplying an array to the ‘version[]’ parameter, the ‘openssl_verify()’ function receives an incorrect data type, leading to a TypeError and an HTTP 500 error for all users, effectively causing a denial of service. The vulnerability carries a CVSS score of 7.5 (HIGH), indicating a high severity due to its network-based attack vector, low attack complexity, and high impact on availability, with no impact on confidentiality or integrity. No authentication or user interaction is required for exploitation. Currently, there is no evidence of active exploitation in the wild, and it is not listed in the CISA KEV catalog. While no Metasploit or ExploitDB modules exist, a Nuclei template for unauthenticated persistent DoS is available. Community discussion and media coverage for this CVE are minimal.