CVE-2026-41670 - Vulnerability Analysis

Overview

Admidio < 5.0.9 contains an information disclosure vulnerability caused by unvalidated AssertionConsumerServiceURL in SAML AuthnRequest, letting attackers with knowledge of Entity ID redirect signed SAML responses to attacker-controlled URLs, exploit requires attacker to know registered SP client Entity ID.

Severity & Score

Impact

Attackers can obtain signed SAML responses with user identity attributes by redirecting them to attacker-controlled URLs, leading to sensitive information disclosure.

Mitigation

Upgrade to version 5.0.9 or later.

References

• https://github.com/Admidio/admidio/security/advisories/GHSA-p9w9-87c8-m235
• https://github.com/Admidio/admidio/releases/tag/v5.0.9

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner