CVE-2026-96632: AdminNeo Vulnerable to XSS via Rogue MySQL Server Version String (CSP Nonce Bypass)

AdminNeo inserts the database server’s version string into a <script> tag that carries a valid CSP nonce, without any sanitization. A rogue database server can return a crafted version string that breaks out of the JavaScript context and executes arbitrary code. Because the script tag already has a valid nonce, the browser’s Content Security Policy does not block execution. No authentication is required when combined with Login CSRF.

Originally reported in Adminer: https://github.com/vrana/adminer/security/advisories/GHSA-h6jr-7pr6-grgj