Executive brief
Admidio is a web-based user management system. A security flaw allows an attacker to trick an administrator into visiting a malicious website that silently disables or re-enables Single Sign-On (SSO) connections. This can cause a service outage where users are unable to log in to connected applications, or it could re-enable insecure connections that were previously deactivated by staff.
Technical details
A Cross-Site Request Forgery (CSRF) vulnerability exists in `modules/sso/clients.php` within the `enable` action. While other state-changing branches in this file validate an `adm_csrf_token`, the `enable` branch fails to do so and incorrectly processes state changes via GET requests. An attacker can craft a malicious URL or hidden image tag targeting an authenticated administrator to toggle the `smc_enabled` (SAML) or `ocl_enabled` (OIDC) flags for specific client UUIDs. This can be used to disable active SSO providers, causing a denial-of-service for users relying on those providers, or to re-enable providers that were intentionally deactivated. The vulnerability is patched in version 5.0.10.
Affected products
- Admidio Admidio <= 5.0.9
Timeline
- 2026-05-25: disclosed
- 2026-05-29: advisory: GHSA-xg76-5qj2-2hhv published
- 2026-05-29: patched: Fixed in version 5.0.10