Description

Admidio is an open-source user management solution. Prior to version 5.0.10, `modules/sso/clients.php` validates an `adm_csrf_token` on every state-changing branch except `enable`. The `enable` case loads the SAML or OIDC client by UUID, calls `$client->enable($enabled)`, and persists the new state with no token check. Because the action is reachable via plain GET parameters, a third-party page can trick an authenticated administrator into disabling (or silently re-enabling) any configured SAML or OIDC client. Disabling an SSO client breaks every downstream relying-party application that authenticates through it. Version 5.0.10 contains a fix.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-12T14:17:53.910Z",
  "pubdate": "2026-08-12T14:17:53.910Z",
  "executiveSummary": "An authenticated Cross-Site Request Forgery vulnerability exists within the single sign-on client management functionality of Admidio prior to version 5.0.10.\nThe flaw allows an external third-party page to manipulate the state of configured SAML and OIDC authentication clients by tricking an authenticated administrator into processing unintended requests.\nSuccessful exploitation results in the unauthorized disabling or re-enabling of SSO clients, immediately disrupting authentication services and breaking downstream relying-party applications dependent on the Admidio instance.\nThe vulnerability resides in the lack of anti-CSRF token validation within a specific state-changing branch of the application logic.\nAttackers require no prior administrative privileges within the application itself, but rely on social engineering or malicious web pages to force authenticated administrators to trigger the vulnerable GET-based endpoint.\nRemediation requires upgrading the Admidio installation to version 5.0.10 or later, which properly implements session token validation for all state-changing operations.",
  "technicalDetails": "The vulnerability is rooted in inadequate request validation within the Admidio codebase, specifically inside the modules/sso/clients.php file.\nWhile the application enforces the validation of the adm_csrf_token parameter across most state-changing execution branches, the specific code block handling the enable action omits this critical security control.\nConsequently, when a request targets the enable case, the application loads the targeted SAML or OIDC client via its unique identifier (UUID), directly executes the $client->enable($enabled) method, and subsequently persists the modified state to the backend database without verifying the authenticity of the request via a cryptographic token.\nBecause the action is exposed via plain GET parameters, it does not require complex payload delivery mechanisms.\nThe attack flow proceeds as follows: An attacker crafts a malicious external web page or embeds a specially formatted hyperlink within an HTML image tag, iframe, or automated JavaScript redirection pointing to the administrative endpoint of the vulnerable Admidio instance with the parameters configured to alter an SSO client's state.\nWhen an authenticated Admidio administrator visits the malicious page or views the embedded resource while maintaining an active administrative session, the browser automatically includes the session cookies in the cross-site request.\nThe Admidio server processes the incoming GET request, trusts the session context, and executes the state change in modules/sso/clients.php without prompting or validating an adm_csrf_token.\nThe affected component is the SSO client management module, specifically impacting Admidio versions prior to 5.0.10.\nThe vulnerability requires network exposure of the Admidio application, an active administrative session, and victim interaction via a third-party context.\nThe post-exploitation impact includes denial of service for downstream relying-party applications that rely on the affected SAML or OIDC endpoints for user authentication, as well as potential administrative confusion caused by unauthorized state cycling."
}