Input validation error in Admidio - CVE-2026-41670
Published: April 23, 2026
Vulnerability identifier: #VU127171
CSH Severity: High
CVSS v4: 7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-41670
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to disclose sensitive information and impersonate a user at a service provider.
The vulnerability exists due to improper input validation in the SAML IdP implementation in src/SSO/Service/SAMLService.php when processing SAML AuthnRequest messages. A remote attacker can send a crafted AuthnRequest with an attacker-controlled AssertionConsumerServiceURL to disclose sensitive information and impersonate a user at a service provider.
User interaction is required, and exploitation is possible without signature verification when the service provider client uses the default settings for request signing validation.
Affected software
Admidio
How to mitigate CVE-2026-41670
Install security update from vendor's website.
Admidio - update to 5.0.9