Vulnerability · Published May 7, 2026 · Assigned by GitHub_M

CVE-2026-41670Admidio: SAML Response Sent to Unvalidated Assertion Consumer Service URL from AuthnRequest

High 8.2

In plain English

A high-severity improper input validation in admidio from Admidio. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.2High

Exploit odds (30 days)0.3%top 79.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Admidio is an open-source user management solution. Prior to version 5.0.9, the SAML IdP implementation in Admidio's SSO module uses the AssertionConsumerServiceURL value directly from incoming SAML AuthnRequest messages as the destination for the SAML response, without validating it against the registered ACS URL (smc_acs_url) stored in the database for the corresponding service provider client. An attacker who knows the Entity ID of a registered SP client can craft a SAML AuthnRequest with an arbitrary AssertionConsumerServiceURL, causing the IdP to send the signed SAML response -- containing user identity attributes (login name, email, roles, profile fields) -- to an attacker-controlled URL. This issue has been patched in version 5.0.9.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	admidio/admidio	5.0.9	GHSA-p9w9-87c8-m235

Affected products (as reported)

Vendor	Product	Versions
Admidio	admidio	< 5.0.9

Weakness: CWE-20, CWE-601 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

References

https://github.com/Admidio/admidio/security/advisories/GHSA-p9w9-87c8-m235 x_refsource_CONFIRM
https://github.com/Admidio/admidio/releases/tag/v5.0.9 x_refsource_MISC