AdminNeo versions 4.6.0 through at least 5.5.0 are vulnerable to cookie attribute injection via the "X-Forwarded-Prefix" HTTP header. An attacker who can influence this header (e.g., through a reverse proxy that forwards it from clients, an attacker-controlled upstream proxy, or a man-in-the-middle position) can inject arbitrary cookie attributes including "Domain", "Path", "Secure", and "SameSite" into all "Set-Cookie" response headers emitted by AdminNeo. This allows an attacker to expand the cookie scope to an attacker-controlled domain (e.g., "Domain=.evil.com"), causing the victim's browser to send AdminNeo's "neo_sid" (session ID) and "neo_key" (database password encryption key) cookies to the attacker's server on subsequent requests. Originally reported by @retkoussa in Adminer: https://github.com/vrana/adminer/security/advisories/GHSA-c533-9qwm-8w5h