[HIGH] AdminNeo has Cookie Attribute Injection via Unsanitized X-Forwarded-Prefix in Set-Cookie Headers

PKSA-31n1-gk84-zwsg CVE-2026-96631 GHSA-79wv-8rh2-9vp2

Affected package: adminneo-org/adminneo

Affected version: >=4.6.0,<5.5.1

Reported by:
GitHub