The installer/update script doesn't create the missing column. You can create it manually if you're comfortable editing your database. I was updating from 2.4 to 2.5.5 and ran into the same issue.
As with anything you should back up your database BEFORE doing the update or this procedure.
Run the following SQL on your database;
ALTER TABLE `exp_security_hashes` ADD `session_id` VARCHAR( 40 ) NOT NULL DEFAULT '0' AFTER `date`
This will create the necessary column. You can then run the admin.php script and all should be well. I've just done it and everything came back to normal.
I'm not sure why this isn't automatically created. I haven't yet looked at the update script itself to see if it's missing or just failing for some reason.
UPDATE:
There is a function in one of the update files (ud_254.php) that changes the column ip_address
to session_id
. Whether that fails to execute because of permissions, a bug, or if the session_id
column is used before is updated I do not yet know.